RFC 4818

RADIUS Delegated-IPv6-Prefix Attribute

📅 published April 2007, from ietf

RFC 4818: RADIUS Delegated-IPv6-Prefix Attribute 🎀

okay bestie, here's the deal 💅 RFC 4818 is all about a RADIUS attribute called Delegated-IPv6-Prefix, and it's giving standards-track energy ✨

Number: RFC 4818
Title: RADIUS Delegated-IPv6-Prefix Attribute
Authors: J. Salowey and R. Droms, both at Cisco Systems, Inc. 🫶
Category: Standards Track
Date: April 2007
Obsoletes / Updates: the title block doesn't list anything it obsoletes or updates

Status of This Memo 📜

This document is an Internet standards track protocol for the Internet community, and it's asking everyone for discussion and suggestions for improvements 💬 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈

Copyright Notice 🔒

Abstract 🦋

So this doc defines a RADIUS (Remote Authentication Dial In User Service) attribute that carries an IPv6 prefix to be delegated to the user. Bonus: it works with either RADIUS or Diameter 👑

1. Introduction ✨

The Delegated-IPv6-Prefix attribute is a RADIUS [1] attribute that carries an IPv6 prefix to be delegated to the user, so it can be used in the user's network 🏠 For example, a prefix sitting in a Delegated-IPv6-Prefix attribute can be handed on to another node through DHCP Prefix Delegation [2] 🧚

Delegated-IPv6-Prefix can be used in DHCP Prefix Delegation between the delegating router and a RADIUS server. Here's the message sequence, bestie 👀

   Requesting Router   Delegating Router                   RADIUS Server
         |                     |                                 |
         |-Solicit------------>|                                 |
         |                     |-Request------------------------>|
         |                     |<--Accept(Delegated-IPv6-Prefix)-|
         |<--Advertise(Prefix)-|                                 |
         |-Request(Prefix)---->|                                 |
         |<--Reply(Prefix)-----|                                 |
         |                     |                                 |
                DHCP PD                      RADIUS

Now the tea ☕ Framed-IPv6-Prefix [4] is not designed to support delegating IPv6 prefixes for use in the user's network. That's why Framed-IPv6-Prefix and Delegated-IPv6-Prefix are allowed to show up in the same RADIUS packet. Iconic separation of duties 💅

2. Terminology 📖

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [3] 🫶

3. Attribute Format 🧩

Here's what the Delegated-IPv6-Prefix looks like on the wire 👇

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |     Type      |    Length     |  Reserved     | Prefix-Length |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                   Prefix
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                   Prefix
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                   Prefix
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                   Prefix                             |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Let's break down each field 🔍

Type 🏷️ Its value is 123 for Delegated-IPv6-Prefix.

Length 📏 This is the length of the entire attribute, in bytes. The minimum is 4, which holds Type, Length, Reserved, and Prefix-Length for a 0-bit prefix. The maximum is 20, which holds those same fields for a 128-bit prefix.

Reserved 🤫 The sender always sets this to zero, and the receiver ignores it.

Prefix-Length 📐 This is the length of the prefix being delegated, in bits. It can be anywhere from 0 up to 128 bits, with 128 identifying a single IPv6 address.

Something to note 👀 The prefix field only needs to be long enough to hold the prefix bits, so it can be shorter than 16 bytes. Any bits in the prefix field that aren't part of the prefix MUST be zero. No exceptions, periodt 🔥

Now for where this attribute is allowed to show up 🗺️ The Delegated-IPv6-Prefix MAY appear in an Access-Accept packet, and it can appear multiple times. It MAY also appear in an Access-Request packet as a hint from the NAS to the server saying it would prefer these prefix(es). The server isn't required to honor the hint, so it's a suggestion, not a demand 🙈

The Delegated-IPv6-Prefix attribute MAY appear in an Accounting-Request packet 💜

The Delegated-IPv6-Prefix MUST NOT appear in any other RADIUS packets. Hard boundary, bestie 🚫

4. Table of Attributes 📋

This table is your cheat sheet for which attributes can show up in which kinds of packets, and how many of each 🍓

+-------------------------------------------------------------------+
| Request Accept Reject Challenge Accounting  #   Attribute         |
|                                 Request                           |
| 0+      0+     0      0         0+          123 Delegated-IPv6-   |
|                                                 Prefix            |
+-------------------------------------------------------------------+

Here's what the entries mean 🤓

0: This attribute MUST NOT be present.
0+: Zero or more instances of this attribute MAY be present.
0-1: Zero or one instance of this attribute MAY be present.
1: Exactly one instance of this attribute MUST be present.
1+: One or more of these attributes MUST be present.

5. Diameter Considerations 🌸

When you use it in Diameter, this attribute can be used as a Diameter AVP from the Code space 1-255, which is the RADIUS attribute compatibility space. So no new Diameter Code values get allocated 🙌 The data type is:

     Delegated-IPv6-Prefix             OctetString

This attribute has no special translation requirements for Diameter-to-RADIUS or RADIUS-to-Diameter gateways. It gets copied as is, except for changes to headers, alignment, and padding. See also RFC 3588 [5], Section 4.1, and RFC 4005 [6], Section 9 ✨

Whatever the spec says about RADIUS Access-Request applies in Diameter to AA-Request [6] or Diameter-EAP-Request [7]. Whatever it says about RADIUS Access-Accept applies to an AA-Answer or Diameter-EAP-Answer that indicates success. And the RADIUS Accounting-Request rules apply to Diameter Accounting-Request [6] too 💅

The AVP flag rules [5] for Delegated-IPv6-Prefix look like this:

                                      +---------------------+
                                      |    AVP Flag rules   |
                                      |----+-----+----+-----|----+
                     AVP              |    |     |SHLD| MUST|    |
     Attribute Name  Code  Value Type |MUST| MAY | NOT|  NOT|Encr|
     ---------------------------------|----+-----+----+-----|----|
     Delegated-IPv6- 123   OctetString| M  |  P  |    |  V  | Y  |
       Prefix                         |    |     |    |     |    |
     ---------------------------------|----+-----+----+-----|----|

6. IANA Considerations 🏛️

IANA assigned a Type value, 123, for this attribute from the RADIUS Attribute Types registry 🎉

7. Security Considerations 🚨

Okay, this part is serious, so listen up 👂 Known security vulnerabilities of the RADIUS protocol are discussed in RFC 2607 [8], RFC 2865 [1], and RFC 2869 [9]. If you want to use IPsec [10] to secure RADIUS when it's carried in IPv6, RFC 3162 covers that. Security considerations for the Diameter protocol are discussed in RFC 3588 [5] 😭🔐

8. References 📚

8.1. Normative References

   [1]  Rigney, C., Willens, S., Rubens, A., and W. Simpson, "Remote
        Authentication Dial In User Service (RADIUS)", RFC 2865, June
        2000.

   [2]  Troan, O. and R. Droms, "IPv6 Prefix Options for Dynamic Host
        Configuration Protocol (DHCP) version 6", RFC 3633, December
        2003.

   [3]  Bradner, S., "Key words for use in RFCs to Indicate Requirement
        Levels", BCP 14, RFC 2119, March 1997.

9.2. Informative References

   [4]  Aboba, B., Zorn, G., and D. Mitton, "RADIUS and IPv6", RFC 3162,
        August 2001.

   [5]  Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J. Arkko,
        "Diameter Base Protocol", RFC 3588, September 2003.

   [6]  Calhoun, P., Zorn, G., Spence, D., and D. Mitton, "Diameter
        Network Access Server Application", RFC 4005, August 2005.

   [7]  Eronen, P., Hiller, T., and G. Zorn, "Diameter Extensible
        Authentication Protocol (EAP) Application", RFC 4072, August
        2005.

   [8]  Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy
        Implementation in Roaming", RFC 2607, June 1999.

   [9]  Rigney, C., Willats, W., and P. Calhoun, "RADIUS Extensions",
        RFC 2869, June 2000.

   [10] Kent, S. and K. Seo, "Security Architecture for the Internet
        Protocol", RFC 4301, December 2005.

Authors' Addresses 📮

   Joe Salowey
   Cisco Systems, Inc.
   2901 Third Avenue
   Seattle, WA  98121
   USA

   Phone: +1 206.310.0596
   EMail: jsalowey@cisco.com


   Ralph Droms
   Cisco Systems, Inc.
   1414 Massachusetts Avenue
   Boxborough, MA  01719
   USA

   Phone: +1 978.936.1674
   EMail: rdroms@cisco.com

Full Copyright Statement 🌈

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property ⚖️

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also doesn't represent that it has made any independent effort to identify any such rights. Info on the procedures for rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat, and any assurances of licenses to be made available, or the result of an attempt to get a general license or permission for implementers or users to use these proprietary rights, can be obtained from the IETF's online IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology required to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org 🫶

Acknowledgement 💖

Funding for the RFC Editor function is currently provided by the Internet Society ✨

📦 where this page comes from

ietf: rfc4818 2007-04
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms