RFC 6105
IPv6 Router Advertisement Guard
IPv6 Router Advertisement Guard 🎀
okay bestie, the header block first 📋✨ this is RFC 6105, filed under the Informational category (so it's published for info, not as a Standards Track spec 🙈). It's dated February 2011, has ISSN 2070-1721, and comes from the Internet Engineering Task Force (IETF). The authors are E. Levy-Abegnoli, G. Van de Velde (Cisco Systems), C. Popoviciu (Technodyne), and J. Mohacsi (NIIF/Hungarnet) 👑. It doesn't obsolete or update any other RFCs, since none are listed.
Abstract 💜
routed protocols get spoofed a lot, kinda the whole problem 😭 the big official fix for IPv6 is Secure Neighbor Discovery (SEND), but it's honestly not easy to deploy. so this doc proposes a lighter-weight sidekick for SEND 🦋 it works by filtering traffic in the layer-2 network fabric, using a bunch of different criteria, like SEND status for example ✨
Status of This Memo 🌸
this is not an Internet Standards Track spec. it's published for informational purposes only 💅
it's a product of the IETF, reflects the consensus of the IETF community, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG). not every IESG-approved doc is eligible for any level of Internet Standard, so check Section 2 of RFC 5741 if you're curious 🧚
for the current status, errata, and how to send feedback, look at http://www.rfc-editor.org/info/rfc6105 🔗
Copyright Notice 🌈
Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. 💖
this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. please actually read those, because they spell out your rights and restrictions for this doc 🫶 any Code Components pulled out of this document must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License 🍓
this document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. the people controlling the copyright in some of that material may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process 😬 so unless you get an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works may not be created outside it either. the one exceptions are formatting it for publication as an RFC, or translating it into languages other than English 🌸
Table of Contents 📚
1. Introduction ....................................................3
2. Model and Applicability .........................................3
3. Stateless RA-Guard ..............................................5
4. Stateful RA-Guard ...............................................6
4.1. State Machine ..............................................6
4.2. SEND-Based RA-Guard ........................................8
5. RA-Guard Use Considerations .....................................8
6. Security Considerations .........................................9
7. Acknowledgements ................................................9
8. References ......................................................9
8.1. Normative References .......................................9
8.2. Informative References .....................................91. Introduction ✨
okay so picture this 🎀 you're running IPv6 on a shared layer-2 (L2) network segment, and not every device on it fully supports SEND. or maybe the infrastructure to support SEND just isn't there yet [RFC3971]. either way, there's always a risk of operational problems from rogue Router Advertisements (RAs). these can be sent on purpose or by accident, by unauthorized or badly configured routers that plug into the segment 😭
people have already done work on this, leading to studies and code, including [NDPMON] [KAME] [IPv6-SAMURAIS] 💜 this document lays out a solution framework for the rogue-RA problem [RFC6104]. the idea is that network segments get built around a single L2-switching device, or a set of them, that can spot invalid RAs and block them 🦋 the solutions in this framework can range from basic to advanced. basic means the L2 device's port is statically told whether to forward RAs coming from the device connected to it or not. advanced means the L2 device uses some criterion to dynamically validate or invalidate each RA it gets, and that criterion can even be based on SEND mechanisms 🧚
2. Model and Applicability 🌷
RA-Guard is for environments where every message between IPv6 end-devices goes through the controlled L2 networking devices 🫶 it does not apply to shared media, where devices can talk directly without passing through an RA-Guard-capable L2 networking device 🙅♀️
here's Figure 1, a deployment scenario for RA-Guard 👇
Block Allow
+------+ incoming +---------+ incoming +--------+
|Host | RA | L2 | RA | Router |
| |----------------| device |--------------| |
+------+ +----+----+ +--------+
|
|Block
|incoming
|RA
|
|
|
+---+---+
| Host |
| |
+-------+
Figure 1RA-Guard is not trying to replace SEND-based solutions 💅 it's a complement, meant for environments where SEND might not be suitable or fully supported by every device involved. it may take a while before SEND is everywhere in IPv6 networks and some of the large-scale deployment stuff gets sorted out, like provisioning hosts with trust anchors 🌸 it's also reasonable to expect that some devices, like IPv6-enabled sensors, might never implement SEND at all 🤖 an RA-Guard implementation that SEND-validates RAs on behalf of hosts could make some of these challenges way easier ✨
in terms of router authorization, RA-Guard can be seen as a superset of SEND 👑 its job is to filter Router Advertisements based on a set of criteria. that ranges from something super simple like "RA disallowed on a given interface," to "RA allowed from pre-defined sources," all the way up to a full-fledged SEND "RA allowed from authorized sources only" 💖
on top of that granularity in filtering criteria, RA-Guard brings in the concept of a router authorization proxy 🦋 instead of every node on the link analyzing RAs and making its own decision, a legitimate "node-in-the-middle" does the analysis for everyone else on the link 🧚 the analysis itself isn't different from what each node would do. if SEND is enabled, the RA is checked against X.509 certificates [RFC4861]. if any other criterion is in use, like known L3 (addresses) or L2 (link-layer address, port number) legitimate sources of RAs, the node-in-the middle can apply that criterion and filter out any RA that doesn't comply 🍓 and if this node-in-the-middle is an L2 device, it won't change the content of the validated RA, so it avoids all the ND-proxy pitfalls 🙌
so RA-Guard aims to give simple solutions to the rogue-RA problem in contexts where simplicity matters 🎀 it does this while leveraging SEND in an environment that's a mix of SEND-capable devices (L2 switches and routers) and devices that don't consistently use SEND. plus, RA-Guard makes SEND deployments simpler, since only the L2 switch and the routers need to carry certificates (their own, plus the trust anchor certificates) 💜
3. Stateless RA-Guard 🌈
stateless RA-Guard looks at incoming RAs and decides whether to forward or block them. it only uses info found in the message itself or in the L2-device configuration 🧠 the typical info available in the frames received, useful for RA validation, is:
- Link-layer address of the sender
- Port on which the frame was received
- IP source address
- Prefix list
the following configuration info created on the L2 device can be made available to RA-Guard, so it can be checked against what's in the received RA frame:
- Allowed/Disallowed link-layer address of the RA sender
- Allowed/Disallowed ports for receiving RAs
- Allowed/Disallowed IP source addresses of the RA sender
- Allowed Prefix list and Prefix ranges
- Router Priority
once the L2 device has validated the RA frame's content against the configuration, it forwards the RA to its destination, whether that's unicast or multicast ✨ otherwise, the RA gets dropped 💀
here's a super simple stateless RA-Guard setup 🍓 picture a small L2 switch where one interface is statically configured as the one connecting to a router, and all the other interfaces are for non-router devices. in this tiny setup, the only interface forwarding RAs is that pre-assigned router interface, while the non-router interfaces block every RA 🔥
4. Stateful RA-Guard 🦋
4.1. State Machine 🧠
Okay so stateful RA-Guard is lowkey the smart one 💅 It learns on its own who the legit RA senders are and stores that info so later RAs can get through. A simple version is for the L2 device to listen to RAs for a set window of time 🕰️ The start of that window and how long it lasts for one run are both controlled by manual intervention. After that, the L2 device only allows future RAs on the ports where it actually saw valid RAs during the window 🎀 Usually the "LEARNING" state only gets turned on by manual configuration when a new IPv6 router gets provisioned on the L2 network 🌸
A more sophisticated stateful scheme is based on SEND and is described in Section 4.2 💜
The state machine for stateful RA-Guard can be global, per-interface, or per-peer, depending on the scheme used for authorizing RAs 🌈
When RA-Guard is SEND-based, the state machine is per-peer and defined in [RFC3971] 🫶
When RA-Guard is using a discovery method, the state machine of the RA-Guard capability has four different states, and honestly, each one has its own vibe ✨
State 1: OFF 🙈
A device or interface in the RA-Guard "OFF" state operates as if the RA-Guard capability is not available. Basically it's sleeping 😴
State 2: LEARNING 🔍
A device or interface in the RA-Guard "LEARNING" state is actively acquiring information about the IPv6 routing devices connected to its interfaces. The learning process takes place over a pre-defined unique period of time, as set by manual configuration, or it can be event-triggered. The info it gathers gets compared against pre-defined criteria (criteria similar to the stateless RA-Guard rules) to check whether the RAs are valid 👀
In this state, the RA-Guard-enabled device or interface is either blocking "all" RAs until their validity is verified or, alternatively, it can temporarily forward "all" of the RAs until their validity is verified. Pick your fighter 🥊
When the L2 device reaches the end of the LEARNING state, it has a record of which interfaces are attached to links with valid IPv6 routers. The L2 device transitions each interface from the LEARNING state into either the BLOCKING state if there was no valid IPv6 router discovered at the interface, or into the FORWARDING state if there was a valid IPv6 router discovered. So it's either a yes or a no, no cap 🍓
State 3: BLOCKING 🚫
A device or interface running RA-Guard and in the BLOCKING state will block ingress RA messages. Nothing gets in 🔒
An interface can transition from the BLOCKING state into the FORWARDING state directly if explicitly instructed by the L2-device operator 🦋
An interface can transition from the BLOCKING state into the LEARNING state if either explicitly instructed by the L2-device operator or prompted by a triggered event 🔄
State 4: FORWARDING ✅
A device or interface running RA-Guard and in the FORWARDING state will accept valid ingress RAs and forward them to their destination. This is the iconic "come on in" mode 👑
An interface can transition from the FORWARDING state into the BLOCKING state directly if explicitly instructed by the L2-device operator 🧱
An interface can transition from the FORWARDING state into the LEARNING state if either explicitly instructed by the L2-device operator or prompted by a triggered event 🔁
The transition between these states can be triggered by manual configuration or by meeting a pre-defined criterion. It's giving full control to the operator 🎀
4.2. SEND-Based RA-Guard 🔐
In this scenario, the L2 device is blocking or forwarding RAs based on SEND considerations. The moment it captures an RA on the interface, the L2 device first verifies the Cryptographically Generated Address (CGA) [RFC3971] and the RSA (Rivest, Shamir, and Adleman algorithm for public-key cryptography) signature, as specified in Section 5 of [RFC3971]. The RA should be dropped if this verification fails 🚮 Then it applies host behavior as described in Section 6.4.6 of [RFC3971]. In particular, the L2 device tries to retrieve a valid certificate from its cache for the public key referred to in the RA. If it finds one, the L2 device forwards the RA to its destination ✨ If not, the L2 device generates a Certification Path Solicitation (CPS) [RFC3971] with an unspecified source address, to query the router certificate(s). Then it captures the Certification Path Advertisement (CPA) [RFC3971] and tries to validate the certificate chain. If the chain fails validation, the RA gets dropped 💀 If validation succeeds, the L2 device forwards the RA to its destination and stores the router certificate in its cache 🫶
In order to operate in this scenario, the L2 device should be provisioned with a trust anchor certificate, as specified in Section 6 of [RFC3971]. It may also establish layer-3 connectivity with a Certificate Revocation List (CRL) Certification Path Advertisement server and/or with an NTP server 🌐 A bootstrapping issue in this case can be resolved by using the configuration method to specify a trusted port to a first router, and the SEND-based RA-Guard method on all other ports. The first router can then be used for Network Time Protocol (NTP) [RFC5905] and CRL connectivity. It's a whole chain of trust, bestie 🔗
5. RA-Guard Use Considerations 🕸️
The RA-Guard mechanism is effective only when all messages between IPv6 devices in the target environment traverse controlled L2 networking devices. In the case of environments such as Ethernet hubs, devices can communicate directly without going through an RA-Guard-capable L2 networking device, and the RA-Guard feature cannot protect against rogue RAs. So if there's a hub in the mix, RA-Guard just can't see the traffic 🙅♀️
RA-Guard mechanisms do not offer protection in environments where IPv6 traffic is tunneled. Tunnels are a no-go zone for this one 🚇
6. Security Considerations 🛡️
Once RA-Guard has set up the proper criteria (for example, it specified that a port is allowed to receive RAs, or it identified legitimate sources of RAs or certificate bases [RFC4861]), then there are no possible instances of accidentally filtered legitimate Router Advertisements, assuming the RA-Guard filter enforcement strictly follows the RA-Guard set criteria. Serious, safe, and sound 🔥
In Section 4.1, a simple mechanism to dynamically learn the valid IPv6 routers connected to an L2 device is explained. It is important that this LEARNING state is only entered intentionally by manual configuration. The list of learned IPv6 routers should be verified by the network manager to make sure that it corresponds with the expected valid RA list. This procedure will make sure that either accidentally or intentionally generated rogue RAs are blocked by RA-Guard. This part is NOT a drill, besties 🚨
7. Acknowledgements 🕯️
The authors dedicate this document to the memory of Jun-ichiro Hagino (itojun) for his contributions to the development and deployment of IPv6. 🌸💜 Legend behavior, honoring a real one.
8. References 📚
8.1. Normative References
[RFC3971] Arkko, J., Ed., Kempf, J., Zill, B., and P. Nikander,
"SEcure Neighbor Discovery (SEND)", RFC 3971, March 2005.
[RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman,
"Neighbor Discovery for IP version 6 (IPv6)", RFC 4861,
September 2007.
[RFC5905] Mills, D., Martin, J., Ed., Burbank, J., and W. Kasch,
"Network Time Protocol Version 4: Protocol and Algorithms
Specification", RFC 5905, June 2010.8.2. Informative References 📖
[NDPMON] LORIA/INRIA, "NDPMon - IPv6 Neighbor Discovery Protocol
Monitor", November 2007,
<http://ndpmon.sourceforge.net/>.
[KAME] KAME Project, "rafixd - developed at KAME - An active
rogue RA nullifier", November 2007,
<http://www.kame.net/>.
[IPv6-SAMURAIS]
Hagino (itojun), J., "IPv6 demystified: I have a problem
with rogue RAs in my IPv6 network", 2007,
<http://ipv6samurais.com/>.
[RFC6104] Chown, T. and S. Venaas, "Rogue IPv6 Router Advertisement
Problem Statement", RFC 6104, February 2011.Authors' Addresses 💌
Eric Levy-Abegnoli
Cisco Systems
Village d'Entreprises Green Side - 400, Avenue Roumanille
Biot - Sophia Antipolis, PROVENCE-ALPES-COTE D'AZUR 06410
France
Phone: +33 49 723 2620
EMail: elevyabe@cisco.com
Gunter Van de Velde
Cisco Systems
De Kleetlaan 6a
Diegem 1831
Belgium
Phone: +32 2704 5473
EMail: gunter@cisco.com
Ciprian Popoviciu
Technodyne
111 Wood Ave. S.
Iselin, NJ 08830
USA
Phone: +1 1 919 599-5666
EMail: chip@technodyne.com
Janos Mohacsi
NIIF/Hungarnet
18-22 Victor Hugo
Budapest H-1132
Hungary
EMail: mohacsi@niif.hu📦 where this page comes from
- ietf: rfc6105 2011-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms