RFC 4562
MAC-Forced Forwarding: A Method for Subscriber Separation on an Ethernet Access Network
MAC-Forced Forwarding: A Method for Subscriber Separation on an Ethernet Access Network 🎀
Okay bestie, paperwork first 📋✨ This is RFC 4562, filed under the Network Working Group. It was written by T. Melsen and S. Blake from Ericsson and dated June 2006. The category is Informational 🌸, so it's here to share knowledge, not to set a standard. The title block doesn't list anything it obsoletes or updates, so there's no drama there 💅
Status of This Memo
This memo gives information to the Internet community 💜 It doesn't specify an Internet standard of any kind. Distribution of this memo is unlimited 🦋
Copyright Notice
Copyright (C) The Internet Society (2006) ✨
Abstract 🌈
This doc is about making sure LAN stations stay separated at layer 2 when they reach an IPv4 gateway over a bridged Ethernet segment 🫶
The star of the show is called "MAC-Forced Forwarding." It's an Address Resolution Protocol (ARP) proxy that stops Ethernet Media Access Control (MAC) address resolution between hosts in the same IPv4 subnet but at different customer premises. Basically it sends all upstream traffic to an IPv4 gateway 😭 The IPv4 gateway is still the one giving those same hosts IP-layer connectivity, so they can all still talk. It's giving organized chaos but make it secure 🔥
Table of Contents
1. Introduction ....................................................2
1.1. Access Network Requirements ................................3
1.2. Using Ethernet as an Access Network Technology .............4
2. Terminology .....................................................5
3. Solution Aspects ................................................6
3.1. Obtaining the IP and MAC Addresses of the Access Routers ...6
3.2. Responding to ARP Requests .................................7
3.3. Filtering Upstream Traffic .................................8
3.4. Restricted Access to Application Servers ...................8
4. Access Router Considerations ....................................8
5. Resiliency Considerations .......................................9
6. Multicast Considerations ........................................9
7. IPv6 Considerations ............................................10
8. Security Considerations ........................................10
9. Acknowledgements ...............................................11
10. References ....................................................11
10.1. Normative References .....................................11
10.2. Informative References ...................................121. Introduction ✨
The whole point of an access network is to connect customer hosts to service provider access routers (ARs) 🌷 Those ARs usually give you a way onto the Internet and other IP networks, and/or IP-based applications.
An access network can be split into two parts: a subscriber line part and an aggregation network part 🧚 The subscriber line, aka "the first mile," is basically one physical connection (or a logical one, for some wireless tech) to each customer premises. The aggregation network, aka "the second mile," is where all that customer traffic gets bundled up and concentrated 💖
The subscriber lines and the aggregation network meet at an Access Node (AN). So the AN is the border between each individual line and the shared aggregation network 🦋 Here's the picture:
Access Aggregation Access Subscriber Customer
Routers Network Nodes Lines Premises
Networks
+----+ |
--+ AR +-----------| +----+
+----+ | | +----------------[]--------
|--------+ AN |
| | +----------------[]--------
| +----+
|
| +----+
| | +----------------[]--------
|--------+ AN |
| | +----------------[]--------
| +----+
|
| +----+
| | +----------------[]--------
|--------+ AN |
+----+ | | +----------------[]--------
--+ AR +-----------| +----+
+----+ |1.1. Access Network Requirements 💅
There are two basic requirements an access network solution has to satisfy:
- Layer-2 separation between customer premises. 🔒
- High IPv4 address assignment efficiency. 🌸
So here's the deal: all traffic going to and from customer hosts at different premises (so, hosts on different subscriber lines or different access networks) has to be forwarded through an AR. It can't just get bridged or switched at layer 2 (that's Requirement 1, and it's also in requirement R-40 of [TR101]) 😤 Why? So the access network provider can use the AR(s) to do security filtering, policing, and accounting on all customer traffic. That means there shouldn't be any layer-2 paths inside the access network that bypass an AR, with a few exceptions (see Section 3.4) 🙈
In ATM-based access networks, keeping each customer host's traffic separate is built in, because the customer's access device (like a DSL modem) gets its own ATM permanent virtual connections (PVCs) to the AR. That AR is usually bundled with access control in a Broadband Remote Access Server (BRAS) 🎀 In that setup the AN is an ATM-based Digital Subscriber Line Access Multiplexer (DSLAM).
This document, though, is about Ethernet-based access networks 🍓 Techniques other than ATM PVCs must be used to keep each customer host's traffic separated.
Efficient address assignment matters because IPv4 space is scarce (that's Requirement 2). See [RFC3069] for more on this 💜 Assignment is more efficient when host addresses come out of one or more big pools, rather than from separate, smaller subnet blocks handed to each customer premises. IPv6 address assignment is way less of a worry, and IPv6 deployments are expected to give each customer premises its own IPv6 subnet block [v6BB] 🌈
1.2. Using Ethernet as an Access Network Technology ✨
The big thing about Ethernet as an access technology is that traffic for different customer hosts travels over one shared broadcast network 👀 You could get layer-2 isolation between customer premises networks by putting access router functionality in each EAN and treating each subscriber line as its own IP interface. But there are lots of reasons to avoid IP routing in the access network, like regulations that require direct layer-2 access to multiple IP service providers. Plus, that approach still wouldn't solve Requirement 2 🙃
So to dodge IP routing inside the access network, the Ethernet aggregation network gets bridged, via EANs, to individual Ethernet networks at customer premises. If the EANs were regular Ethernet bridges, hosts at different customers' premises would have direct layer-2 visibility of each other. Hosts in the same IP subnet would be especially visible. That breaks Requirement 1 (Section 1.1) and creates security problems, because a malicious end user could attack hosts at other premises directly at the Ethernet layer 😭
There are existing standardized solutions for preventing layer-2 visibility between stations:
- PPP over Ethernet [RFC2516]. PPPoE creates individual PPP sessions between hosts and one or more BRASes over a bridged Ethernet topology. Traffic always flows between a BRAS and a host, never directly between two hosts 🧚 The AN can force upstream traffic to go only to the BRAS the host initially picked.
- VLAN per-customer premises network [RFC3069]. Traffic to and from each customer premises network can be split into different VLANs across the aggregation network, between the AN and the AR 🦋
Both solutions give layer-2 isolation between customer hosts, but they aren't considered optimal for broadband access networks, because:
- PPPoE doesn't support efficient multicast. Packets have to be copied onto each PPPoE session for hosts listening to a given multicast group. That cancels out one of the big perks of using Ethernet instead of ATM as an access technology 😩 It's an especially painful limit for services like IPTV, which need high bandwidth per multicast group (channel) and can have hundreds or thousands of listening customer hosts per group 📺
- Using VLANs to isolate customer premises networks also forces multicast packets to be copied to every VLAN that has a listening host. On top of that, the basic limit of 4096 VLANs per Ethernet network caps how far the solution can scale 🙈 You can get rid of that scalability limit by using VLAN stacking inside the access network, but that makes provisioning more complicated 💀
The solution proposed in this document avoids these problems 💖
2. Terminology 🎀
Here's the vocab you need, bestie 📚
- Access Node (AN): The entity that connects individual subscriber lines to the shared aggregation network 🌸
- Access Router (AR): The entity that connects the access network to the Internet or other IP-based networks. The AR provides connectivity between hosts on the access network at different customer premises. It's also used for security filtering, policing, and accounting of customer traffic 👑
- Application Server (AS): A server, usually owned by a service provider, that attaches directly to the aggregation network and can be reached at layer 2 by customer hosts 🫶
- Ethernet Access Node (EAN): An Access Node that supports Ethernet-based subscriber lines, uplinks to an Ethernet-based aggregation network, and MAC-Forced Forwarding. For xDSL access, the EAN is an Ethernet-centric DSLAM 🌈 The EAN is a special kind of filtering bridge. It doesn't forward Ethernet broadcast and multicast frames that come in on a subscriber line to other subscriber lines. It either discards them or forwards them upstream (toward the aggregation network) 😤 It also discards unicast Ethernet frames that come in on a subscriber line and aren't addressed to an AR. Main character energy, literally 👑✨
3. Solution Aspects ✨
okay so the basic vibe of this solution is that the EAN makes sure upstream traffic ALWAYS heads to a designated AR 🫶, even when the IP traffic is actually going between customer hosts sitting in the same IP subnet. no cap, it's giving routing drama 💅
The solution has three major aspects:
- Initially, the EAN obtains the IP and MAC addresses of the allowed target ARs for each customer host.
- The EAN replies to any upstream ARP request [RFC0826] from customer hosts with the MAC address of an allowed target AR.
- The EAN discards any upstream unicast traffic to MAC addresses other than the allowed target ARs. The EAN also discards all non-essential broadcast and multicast packets received on subscriber lines.
we'll go through these aspects in the next sections 🧚
3.1. Obtaining the IP and MAC Addresses of the Access Routers
okay so an access network can have multiple ARs 🦋, and different hosts can be assigned to different (groups of) ARs. that means the EAN must register the assigned AR addresses on a per-customer-host basis. main character energy for the EAN, honestly 👑
For each customer host, one of the ARs is acting as the default gateway. if a customer has simultaneous access to multiple ARs, the other ARs will typically provide access to other IP networks 🌸
the EAN learns the IPv4 address of the allowed target ARs in one of two ways, depending on how the host gets its IPv4 address. for each host using Dynamic Host Configuration Protocol (DHCP), the EAN learns the AR IPv4 addresses dynamically by snooping the DHCPACK reply to a host [RFC2131]. if a host using DHCP shall have simultaneous access to multiple ARs, DHCP option 121 [RFC3442] or DHCP option 33 [RFC2132] must be used to specify them for that host. if static address assignment is used instead of DHCP, then AR IPv4 addresses must be pre-provisioned in the EAN by the network operator. in both cases, the EAN will ARP to figure out the ARs' corresponding MAC addresses. this can happen immediately after the IPv4 addresses are learned, or when the MAC addresses are first required ✨
the DHCP server can associate customer hosts with subscriber lines if the EAN uses the DHCP Relay Agent Information Option (82) to convey a subscriber line identifier to the DHCP server in DHCP messages flowing upstream from the customer host [RFC3046]. iconic teamwork 🎀
3.2. Responding to ARP Requests
okay imagine if every customer network got its own individual IP subnet block (and routing protocols were blocked inside the access network 🙈). then all upstream traffic would normally go to an AR (typically the default gateway), and the EAN could validate all upstream traffic just by checking that the destination MAC address matched an AR. easy peasy 🍓
BUT, to comply with Requirement 2 of Section 1.1, residential customer networks are not (usually) assigned individual IPv4 subnet blocks. so several hosts at different premises are all in the same IPv4 subnet 😭. that means if a host wants to talk to a host at another premises, it issues an ARP request to get that host's MAC address. this request gets intercepted by the EAN's ARP proxy, and an ARP reply is sent, specifying an allowed AR MAC address (typically the default gateway's) as the requested layer-2 destination address. it's kind of like the "proxy ARP" mechanism described in [RFC1812] 🧚 this way, the ARP table of the requesting host registers an AR MAC address as the layer-2 destination for any host within that IPv4 subnet (except those at the same customer premises, see below).
ARP requests for the IPv4 address of an allowed target AR get replied to by the EAN's ARP proxy with that AR's MAC address, not the MAC address of the default gateway AR 💖
there's an exception when a host is ARPing for another host in the same premises network. if this ARP request reaches the EAN, it should be discarded, because it's assumed the target host inside the premises network will answer it directly 🙈. the EAN must keep track of all assigned IPv4 addresses on a subscriber line so it can detect these ARP requests and discard them. the attention to detail is iconic 👑
3.3. Filtering Upstream Traffic
so, the EAN's ARP proxy always replies with the MAC address of an AR, which means the requesting host never learns the MAC addresses of hosts at other premises 🦋. however, malicious customers or malfunctioning hosts may still try to send traffic to other unicast destination MAC addresses. the EAN must discard all unicast frames received on a subscriber line that are not addressed to the destination MAC address of an allowed AR (with some exceptions; see Section 3.4.
similarly, broadcast or multicast packets received on a subscriber line must never be forwarded on other subscriber lines. they only go out on EAN uplinks to the aggregation network 🌈. an EAN must discard all non-ARP broadcast packets received on subscriber lines, EXCEPT when DHCP is in use. in that case, the EAN must forward client-to-server DHCP broadcast messages (DHCPDISCOVER, DHCPREQUEST, DHCPDECLINE, DHCPINFORM) [RFC2131] upstream. an EAN should rate limit upstream broadcast packets 🫶
broadcast packets forwarded on an EAN uplink may get forwarded to other EANs by the aggregation network. EANs should discard all broadcast packets received from the aggregation network, except ARPs from ARs for subscriber hosts and server-to-client DHCP messages (DHCPOFFER, DHCPACK, DHCPNAK) [RFC2131] when DHCP is in use 💅
filtering of multicast packets to and from an EAN uplink is discussed in Section 6 ✨
3.4. Restricted Access to Application Servers
the previous discussion (Section 3.1) explains how customer hosts are only allowed direct layer-2 connectivity to one or more ARs. but a customer host could ALSO be allowed direct layer-2 access to one or more Application Servers (ASes) that are directly connected to the aggregation network 🎀. there's no functional difference in how MAC-Forced Forwarding treats access to ARs and ASes. same energy, different vibes 🧚
4. Access Router Considerations
traffic between customer hosts that belong to the same IPv4 subnet but are located at different customer premises will always get forwarded via an AR 🦋. in this case, the AR forwards the traffic back to the originating network, i.e., on the same interface it was received from. this normally results in an ICMP redirect message [RFC0792] being sent to the originating host 😭. to prevent this behavior, the ICMP redirect function for aggregation network interfaces must be disabled in the AR. bye redirects 💀
5. Resiliency Considerations
the operation of MAC-Forced Forwarding does not interfere with or delay IP connectivity recovery when there's a sustained AR failure ✨. using DHCP to configure hosts with info on multiple redundant ARs, or using Virtual Router Redundancy Protocol (VRRP) [RFC3768] to implement AR redundancy, lets IP connectivity stay up 🫶
MAC-Forced Forwarding is a stateful protocol 🧠. if static IPv4 address assignment is used in the access network, the EAN must be pre-provisioned with state information for the customer hosts that may be reached via a subscriber line, plus the ARs associated with those hosts. when there's a transient EAN failure, the EAN's state database can be quickly recovered from its configuration storage 💖
if DHCP is used to assign IPv4 addresses in the access network, MAC-Forced Forwarding operates as a soft-state protocol 🌸. the DHCP and ARP messages that get snooped to build the EAN state database are usually sent pretty infrequently, so a transient failure may not be detected by either the AR(s) or the customer hosts 😭. therefore, a transient failure of an EAN could lead to an extended loss of connectivity. to minimize connectivity loss, an EAN should maintain its dynamic state database in resilient storage so the database and connectivity can be restored in a timely way 🫶
the EAN is a single point of attachment between a subscriber line and the aggregation network, so the EAN is a single point of connectivity failure. customers who want more resilient connectivity should multi-home 🌈
6. Multicast Considerations
multicast traffic delivery for streams originating within the aggregation network (or further upstream) and delivered to one or more customer hosts in an access network is supported in a scalable way, thanks to Ethernet's native multicast capability 🦋. bandwidth efficiency can be improved if the EAN behaves as an IGMP snooping bridge. e.g., if it snoops on IGMP Membership Report and Leave Group messages originating on subscriber lines to prune the set of subscriber lines it forwards particular multicast groups to [RFC3376] ✨
an EAN must discard all IPv4 multicast packets received on a subscriber line other than IGMP Membership Report and Leave Group messages [RFC3376]. if a customer host wants to source multicast packets to a group, the host must tunnel them upstream to a multicast router. e.g., an AR acting as a Protocol Independent Multicast - Sparse Mode (PIM-SM) Designated Router [RFC2362]. the AR will forward them back into the access network if there are any listening customer hosts 🧚
EAN processing of IPv6 multicast packets is discussed in the next section 💅
7. IPv6 Considerations
MAC-Forced Forwarding is not directly applicable to IPv6 access networks, for the following reasons:
- IPv6 access networks do not require the same efficiency of address allocation as IPv4 access networks. it's expected that customer premises networks will be allocated unique network prefixes (e.g.,
/48) that accommodate large numbers of customer subnets and hosts [v6BB] 🌸 - IPv6 nodes do not use ARP. instead, they use the Neighbor Discovery Protocol [RFC2461] for layer-2 address resolution 🙈
to support both IPv6 and MAC-Forced Forwarding for IPv4 at the same time, an EAN can implement the unicast, broadcast, and multicast filtering rules described in Section 3.3. to filter unicast correctly, the EAN must learn the IPv6 and MAC addresses of the allowed ARs for a particular subscriber line. it can learn these addresses either through static configuration or by snooping Router Discovery messages exchanged between the customer premises router and one or more ARs [RFC2461] 🫶
multicast is an intrinsic part of the IPv6 protocol suite 🌈. therefore, an EAN must not indiscriminately filter IPv6 multicast packets flowing upstream, although it may rate limit them. detailed IPv6 multicast filtering rules are not discussed in this document 💜
8. Security Considerations 🔐
okay so MAC-Forced Forwarding is, by its nature, a security function 🛡️ 💖 It's all about layer-2 isolation of customer hosts that share a broadcast access medium. So in that sense it gives you security equivalent to alternative PVC-based solutions ✨ Any security procedures that fit a shared access medium are equally good fits when MAC-Forced Forwarding is in play. And it does not add any vulnerabilities beyond the ones standard Ethernet bridging already has 🫶
In addition to layer-2 isolation, an EAN implementing MAC-Forced Forwarding must discard all upstream broadcast packets, except for valid DHCP messages and ARP requests (which are proxied by the EAN) 🎀
😭 Bestie, this part is SERIOUS. The EAN must discard any DHCP server replies that come from a subscriber line. No exceptions, no vibes-based decisions 💅
The EAN may also rate limit upstream broadcast DHCP messages 🌸 That part is optional, so it's a "may," not a "must" 🦋
Last but definitely not least: an EAN implementing MAC-Forced Forwarding must keep track of IPv4 addresses allocated on subscriber lines 🧚 Because it has that info, the EAN has enough to discard upstream traffic with spoofed IPv4 source addresses. Main character energy for the security team 👑🔥
9. Acknowledgements 🫶
The authors would like to thank Ulf Jonsson, Thomas Narten, James Carlson, Rolf Engstrand, Tomas Thyni, and Johan Kolhi for their helpful comments 💜 Thank you, besties 🌈
10. References 📚
10.1. Normative References
- [RFC0792] Postel, J., "Internet Control Message Protocol", STD 5, RFC 792, September 1981. 🌸
- [RFC0826] Plummer, D., "Ethernet Address Resolution Protocol: Or converting network protocol addresses to 48.bit Ethernet address for transmission on Ethernet hardware", STD 37, RFC 826, November 1982. 💅
- [RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, March 1997. ✨
- [RFC2132] Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor Extensions", RFC 2132, March 1997. 🎀
- [RFC2362] Estrin, D., Farinacci, D., Helmy, A., Thaler, D., Deering, S., Handley, M., Jacobson, V., Liu, C., Sharma, P., and L. Wei, "Protocol Independent Multicast-Sparse Mode (PIM-SM): Protocol Specification", RFC 2362, June 1998. 🦋
- [RFC3046] Patrick, M., "DHCP Relay Agent Information Option", RFC 3046, January 2001. 🍓
- [RFC3376] Cain, B., Deering, S., Kouvelas, I., Fenner, B., and A. Thyagarajan, "Internet Group Management Protocol, Version 3", RFC 3376, October 2002. 🧚
- [RFC3442] Lemon, T., Cheshire, S., and B. Volz, "The Classless Static Route Option for Dynamic Host Configuration Protocol (DHCP) version 4", RFC 3442, December 2002. ⭐
10.2. Informative References
- [RFC1812] Baker, F., "Requirements for IP Version 4 Routers", RFC 1812, June 1995. 💜
- [RFC3768] Hinden, R., "Virtual Router Redundancy Protocol (VRRP)", RFC 3768, April 2004. 🌈
- [RFC2461] Narten, T., Nordmark, E., and W. Simpson, "Neighbor Discovery for IP Version 6 (IPv6)", RFC 2461, December 1998. 👑
- [RFC2516] Mamakos, L., Lidl, K., Evarts, J., Carrel, D., Simone, D., and R. Wheeler, "A Method for Transmitting PPP Over Ethernet (PPPoE)", RFC 2516, February 1999. 🫶
- [RFC3069] McPherson, D. and B. Dykes, "VLAN Aggregation for Efficient IP Address Allocation", RFC 3069, February 2001. 🌸
- [TR101] DSL Forum, "Migration to Ethernet-Based DSL Aggregation", Technical Report TR-101, April 2006. 🦋
- [v6BB] Asadullah, S., Ahmed, A., Popoviciu, C., Savola, P., and J. Palet, "ISP IPv6 Deployment Scenarios in Broadband Access Networks", Work in Progress. 🍓
Authors' Addresses 💌
Here are the two besties who wrote this, with their contact info 🫶
Torben Melsen
Ericsson
Faelledvej
Struer DK-7600
Denmark
EMail: Torben.Melsen@ericsson.comSteven Blake
Ericsson
920 Main Campus Drive
Suite 500
Raleigh, NC 27606
USA
Phone: +1 919 472 9913
EMail: steven.blake@ericsson.comFull Copyright Statement ©
Copyright (C) The Internet Society (2006). 🌈
This document is subject to the rights, licenses and restrictions contained in BCP 78 and at www.rfc-editor.org/copyright.html, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🙈
Intellectual Property 🔒
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also does not represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. 💌
Acknowledgement 🎀
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). 💖 That's a wrap, bestie ✨🦋
📦 where this page comes from
- ietf: rfc4562 2006-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms