RFC 5579

Transmission of IPv4 Packets over Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) Interfaces

📅 published February 2010, from ietf

1. Introduction ✨

Okay bestie, let's get the title block tea first 🫶 This RFC is RFC 5579, Transmission of IPv4 Packets over Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) Interfaces. F. Templin, Ed. wrote it at Boeing Research & Technology, and it's dated February 2010 📅. It's Informational and came in as an Independent Submission, with ISSN 2070-1721. The title block doesn't list anything it obsoletes or updates, so it's not replacing or changing any other RFC 💅.

Abstract

The Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) is a Non-Broadcast, Multiple Access (NBMA) interface type that sends IPv6 packets over IPv4 networks using automatic IPv6-in-IPv4 encapsulation 🌸. The original specs don't cover encapsulating and sending IPv4 packets, though, which is a gap 🥺. This doc fills it with a method for transmitting IPv4 packets over ISATAP interfaces 🎀.

Status of This Memo

This document is not an Internet Standards Track specification 🙅‍♀️. It's published just for information 📚.

This is a contribution to the RFC Series, independent of any other RFC stream. The RFC Editor chose to publish it at their discretion, and they make no statement about how useful it is for implementation or deployment 🤷‍♀️. Documents the RFC Editor approves for publication aren't candidates for any level of Internet Standard, see Section 2 of RFC 5741 📖.

For the current status, any errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc5579 🔗.

IESG Note

This RFC is not a candidate for any level of Internet Standard 🚫. The IETF doesn't know whether this RFC is fit for any purpose, and its decision to publish wasn't based on IETF review of things like security, congestion control, or bad interaction with deployed protocols 😬. The RFC Editor chose to publish it at their discretion, so readers should be careful about how much they trust it for implementation and deployment ⚠️. See RFC 3932 for more info.

Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date it was published. Please read these carefully, because they spell out your rights and restrictions for this document 📜.

Table of Contents

1. Introduction ....................................................3
2. Terminology .....................................................3
3. ISATAP Interface Model ..........................................3
4. ISATAP Interface MTU ............................................4
5. IPv6 Operation ..................................................4
6. IPv4 Operation ..................................................4
   6.1. ISATAP IPv4 Address Configuration ..........................4
   6.2. IPv4 Route Configuration ...................................5
   6.3. ISATAP Interface Determination .............................5
   6.4. Next-Hop Resolution ........................................5
   6.5. Encapsulation and Transmission .............................6
   6.6. IPv4 Multicast Mapping .....................................6
   6.7. Recursive Encapsulation Avoidance ..........................7
7. Security Considerations .........................................7
8. Acknowledgements ................................................7
9. References ......................................................7
   9.1. Normative References .......................................7
   9.2. Informative References .....................................8
Appendix A. Encapsulation Avoidance ................................9

1. Introduction ✨

Okay so ISATAP [RFC5214] is an NBMA interface type for sending IPv6 packets over IPv4 networks using automatic IPv6-in-IPv4 encapsulation 🌈. ISATAP interfaces usually set up IPv6 addresses and prefixes but not IPv4 ones, so they look like a normal IPv6 interface with a null IPv4 config 😭. That's a real limit on where ISATAP can be used, and it's giving unnecessary 💀.

ISATAP interfaces do automatic IPv6-in-IPv4 encapsulation over a virtual IPv6 overlay that covers a region inside a connected IPv4 routing topology (a "site") made of ordinary IPv4 routers 🦋. They make IPv6 link-local addresses that wrap an IPv4 address from an underlying IPv4 interface inside the IPv6 link-local prefix fe80::/10, as laid out in Sections 6 and 7 of [RFC5214] 💜. They can also set up IPv6 addresses from a non-link-local IPv6 prefix, exactly the same way. So [RFC5214] builds on the basic transition mechanisms from [RFC4213] 🧚.

This doc sets up mechanisms and ops practices that let automatic IPv4-in-IPv4 encapsulation run over ISATAP interfaces, just like IPv6-in-IPv4 does 💅. That means it also extends the IPv4-in-IPv4 tunneling from [RFC2003] ✨. These are useful in lots of enterprise network setups, like the ones discussed in the RANGER [RANGER] and VET [VET] proposals 🏢.

The next sections spell out IPv4 operation over ISATAP interfaces. You're expected to know the IPv4 and IPv6 protocols ([RFC0791] and [RFC2460]), IPv4-in-IPv4 encapsulation [RFC2003], and IPv6-in-IPv4 encapsulation ([RFC4213] and [RFC5214]) already 🫶.

2. Terminology

The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this document, are to be interpreted as described in [RFC2119] 📖.

3. ISATAP Interface Model

ISATAP interfaces use automatic IPv6-in-IPv4 encapsulation to cover a site (a region within a connected IPv4 routing topology) in a single IPv6 hop 🦋. So the site has border nodes with ISATAP interfaces that forward IPv6-in-IPv4 packets across it in one IPv6 hop, plus ordinary IPv4 routers between the border nodes that decrement the Time to Live (TTL) in the outer IPv4 header 🌸. Border nodes with ISATAP interfaces in the same site therefore see each other as single-hop neighbors 👯‍♀️.

ISATAP interfaces get configured over one or more of the node's underlying IPv4 interfaces connected to the site. Those underlying IPv4 interfaces use site- or greater-scoped IPv4 addresses, and the underlying IPv4 interfaces of two "neighboring" ISATAP interfaces can be separated by many IPv4 hops inside the site 🗺️.

This spec just extends the ISATAP interface model to also support IPv4-in-IPv4 encapsulation 💖. When IPv4-in-IPv4 encapsulation is used, the ISATAP interface covers exactly the same underlying site as IPv6-in-IPv4 encapsulation does 🎀.

4. ISATAP Interface MTU

ISATAP interface MTU stuff is exactly as specified in Section 3.2 of [RFC4213], and it applies equally to both IPv6 and IPv4 operation 📏.

5. IPv6 Operation

IPv6 operations over ISATAP interfaces are exactly as specified in [RFC5214] 💜.

6. IPv4 Operation

The following sections specify IPv4 operation over ISATAP interfaces 🌈:

6.1. ISATAP IPv4 Address Configuration

Just like IPv6 operation, IPv4 operation requires that all ISATAP interfaces connected to the same site configure a unique Layer 3 IPv4 address ("L3ADDR") taken from an IPv4 prefix for the site 🏠. L3ADDR is used for next-hop determination, and it can also be the source address for packets that come from the ISATAP interface itself 📮.

When the ISATAP site needs a unique "name" (say, to tell it apart from other ISATAP sites), L3ADDR comes from a public IPv4 prefix 🌍. Otherwise, it can come from a link-local-scoped IPv4 prefix, like 169.254/16 [RFC3927] 🧷.

Ways to make sure L3ADDR is unique include dynamic allocation using DHCP [RFC2131], manual configuration, etc. 🙌

6.2. IPv4 Route Configuration

Like any IPv4 interface, IPv4 Forwarding Information Base (FIB) entries (aka IPv4 routes) get configured over ISATAP interfaces through either administrative or dynamic mechanisms 🗂️.

Next-hop addresses in FIB entries configured over an ISATAP interface match up with the L3ADDR assigned to a neighbor's ISATAP interface 🎯.

6.3. ISATAP Interface Determination

When the node's IPv4 layer has a packet to send, it does an IPv4 FIB lookup to figure out the outgoing ISATAP interface and the next-hop L3ADDR 🔍. Then the node checks the packet length against the MTU configured on the ISATAP interface 📐.

If the packet is no bigger than the MTU, the node lets it into the ISATAP interface without fragmenting it ✅. If the packet is bigger than the MTU, the node checks the "Don't Fragment (DF)" flag in the IPv4 header 👀. If DF=1, it drops the packet and sends an ICMPv4 "fragmentation needed" message back to the original source [RFC1191] 🙅‍♀️. Otherwise, it fragments the packet with IPv4 fragmentation and lets each fragment into the ISATAP interface 🧩.

Heads up: DF=1 means the packet gets dropped, not fragmented, so the sender has to hear about it through that ICMPv4 "fragmentation needed" message 🚨.

6.4. Next-Hop Determination and Address Mapping

Just like ISATAP for IPv6, ISATAP for IPv4 requires a way to figure out the L3ADDR of neighbors on the ISATAP interface that can act as a next-hop toward the final destination 🧭. Next-hop determination for default routes goes through the Potential Router List (PRL) discovery procedures in Section 8.3.2 of [RFC5214] 🛣️. For more-specific routes, next-hop methods include forwarding initial packets via a default router until a redirect comes back, name service lookup (like the one in [VET]), and so on 🔁.

Once a next-hop L3ADDR is discovered, the node lets IPv4 packets and fragments into the ISATAP interface and maps the next-hop L3ADDR to a next-hop Layer 2 address ("L2ADDR") 🪄. In reality, that L2ADDR is the IPv4 address of an underlying interface on the ISATAP neighbor, which might be many IPv4 hops away 🌏.

Address mapping for IPv4 is different from the IPv6 version because there's no algorithmic mapping between L3ADDR and L2ADDR 😤. So ISATAP for IPv4 requires an L3ADDR->L2ADDR address mapping method that's coordinated on a per-site basis, so every node in the site follows the same convention 🤝. Examples include name service lookup (like [VET] describes), static mapping table lookup, and so on 📋.

Next, the node does an IPv4 FIB lookup on the next-hop L2ADDR to find the correct underlying IPv4 interface 🔎. If that FIB lookup fails, the node drops the packet and sends an ICMPv4 "Destination Unreachable" message back to the original source [RFC0792] 🙈. Otherwise, it encapsulates the packet and submits it to the IPv4 layer, as described below 💖.

6.5. Encapsulation and Transmission ✨

Okay bestie, so after the node does the IPv4 FIB lookup on the next-hop L2ADDR, it wraps the packet up using [RFC2003] 🎀. The outer IPv4 source is the IPv4 address of the underlying interface, and the outer IPv4 destination is the next-hop L2ADDR. The DF flag in the outer header gets set according to Section 3.2 of [RFC4213] 💅. The IP protocol field in the outer header also gets set to 4 (that's ip-protocol-4) 🦋.

Then the node hands the encapsulated packet down to the IPv4 layer. If it's too big, the IPv4 layer fragments it, and then each fragment goes out the underlying IPv4 interface. That interface does address resolution on the outer IPv4 destination (aka the next-hop L2ADDR) and sends the packet out on the underlying link layer 🚀.

6.6. IPv4 Multicast Mapping 🧚

Lowkey, ISATAP is basically a unicast-only cousin of "6over4" [RFC2529] 👯. ISATAP ended up getting deployed everywhere, while 6over4 kinda got quietly carried forward through ongoing research 🙈. This spec extends the ISATAP interface model so it supports IPv4 multicast mapping, and it works exactly like the IPv6 multicast mapping in 6over4 (see [RFC2529], Section 6) 💜. Honestly, the approach could've been called "4over4" if "ISATAP" weren't already super ingrained in the terminology 😭.

IPv4 multicast mapping is only available on ISATAP interfaces that are configured over sites supporting IPv4 multicast 🌸. For those sites, an IPv4 packet sent on an ISATAP interface with a multicast destination address DST MUST be encapsulated for transmission on an underlying IPv4 interface, to the IPv4 multicast address of Organization-Local Scope, using the mapping below ✨. The mapped address SHOULD come from the block 239.193.0.0/16. If that's not an option, it can come from a different sub-block of the Organization-Local Scope address block, or, if none of those are available, from the expansion blocks defined in [RFC2365] 🍓.

Quick note: when the mapped address is formed using the expansion blocks, it only uses a /16-sized block 💅.
  +-------+-------+-------+-------+
  |  239  |  OLS  | DST2  | DST3  |
  +-------+-------+-------+-------+

       DST2, DST3          Last two bytes of IPv4 multicast address.

       OLS                 From the configured Organization-Local
                           Scope address block.  SHOULD be 193;
                           see [RFC2365] for details.

                  Figure 1: ISATAPv4 Multicast Mapping

No new IANA registration procedures are required for the above 🌈.

6.7. Recursive Encapsulation Avoidance 🙅‍♀️

The node must take care in managing its IPv4 FIB table entries in order to avoid looping through recursive encapsulations 🔁. Don't let your tunnels eat their own tails, periodt 💀.

7. Security Considerations 🔐

The security considerations specified in [RFC2003] apply equally to this document. The security considerations specified in ISATAP [RFC5214] and 6over4 [RFC2529] also apply, with one exception: ip-protocol-4 encapsulation is used instead of ip-protocol-41 🚨.

Updated tunnel security considerations are found in [SECURITY] 🛡️. Read it, it's serious stuff, no cap ⭐.

8. Acknowledgements 🫶

This work extends the ISATAP interface model, which has evolved through the insights of many contributers over the course of many decades 🌷. Special thanks to Brian Carpenter and Jari Arkko for their helpful review input 💖.

9. References 📚

9.1. Normative References

[RFC0791]  Postel, J., "Internet Protocol", STD 5, RFC 791, September
           1981.

[RFC0792]  Postel, J., "Internet Control Message Protocol", STD 5,
           RFC 792, September 1981.

[RFC1191]  Mogul, J. and S. Deering, "Path MTU discovery", RFC 1191,
           November 1990.

[RFC2003]  Perkins, C., "IP Encapsulation within IP", RFC 2003,
           October 1996.

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2460]  Deering, S. and R. Hinden, "Internet Protocol, Version 6
           (IPv6) Specification", RFC 2460, December 1998.

[RFC2529]  Carpenter, B. and C. Jung, "Transmission of IPv6 over IPv4
           Domains without Explicit Tunnels", RFC 2529, March 1999.

[RFC3927]  Cheshire, S., Aboba, B., and E. Guttman, "Dynamic
           Configuration of IPv4 Link-Local Addresses", RFC 3927, May
           2005.

[RFC4213]  Nordmark, E. and R. Gilligan, "Basic Transition Mechanisms
           for IPv6 Hosts and Routers", RFC 4213, October 2005.

[RFC5214]  Templin, F., Gleeson, T., and D. Thaler, "Intra-Site
           Automatic Tunnel Addressing Protocol (ISATAP)", RFC 5214,
           March 2008.

9.2. Informative References

[SECURITY] Hoagland, J., Krishnan, S., and D. Thaler, "Security
           Concerns With IP Tunneling", Work in Progress, October
           2008.

[VET]      Templin, F., "Virtual Enterprise Traversal (VET)", RFC
           5558, February 2010.

[RANGER]   Templin, F., "Routing and Addressing in Networks with
           Global Enterprise Recursion (RANGER)", RFC 5720, February
           2010.

[RFC2131]  Droms, R., "Dynamic Host Configuration Protocol", RFC
           2131, March 1997.

[RFC2365]  Meyer, D., "Administratively Scoped IP Multicast", BCP 23,
           RFC 2365, July 1998.

Appendix A. Encapsulation Avoidance 🦄

In some instances, an ISATAP interface may be configured over a site in which the L3ADDRs and L2ADDRs of all ISATAP neighbors are also known to be routable within the underlying site. In that case, the ISATAP interface MAY avoid encapsulation and submit the unencapsulated packets directly to the IPv4 layer. Note however that this approach does not provide for the use of indirection afforded through encapsulation 💭.

Author's Address 🎀

Fred L. Templin (editor)
Boeing Research & Technology
P.O. Box 3707 MC 7L-49
Seattle, WA  98124
USA

EMail: fltemplin@acm.org
📦 where this page comes from