RFC 6877
464XLAT: Combination of Stateful and Stateless Translation
RFC 6877: 464XLAT: Combination of Stateful and Stateless Translation 🎀
Okay bestie, the paperwork first! 📋 This one is from the IETF (Internet Engineering Task Force), and it's RFC 6877 💅 It was written by M. Mawatari (Japan Internet Exchange), M. Kawashima (NEC AccessTechnica, Ltd.), and C. Byrne (T-Mobile USA). It's published as Category: Informational, dated April 2013, with ISSN 2070-1721. The header doesn't list any obsoletes or updates, so it's standing on its own. 🦋
Abstract 💖
So this doc describes an architecture called 464XLAT 🧚 It gives you limited IPv4 connectivity on a network that's IPv6-only. How? It mixes two things that already exist and are well known: the stateful protocol translation from RFC 6146 in the core, and the stateless protocol translation from RFC 6145 at the edge. ✨ 464XLAT is simple, it scales, and you can roll out limited IPv4 access to IPv6-only edge networks fast, with no encapsulation needed. It's giving efficient, no cap 🔥
Status of This Memo 📜
Quick heads-up: this is not an Internet Standards Track spec. It's published just for information 🌸
It is a product of the IETF, and it reflects what the IETF community agrees on. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every doc the IESG approves is a candidate for any level of Internet Standard. For that, check Section 2 of RFC 5741 🧐
For the current status, any errata, and where to send feedback, go to http://www.rfc-editor.org/info/rfc6877. 💌
Copyright Notice ©️
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. 🫶
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. Please read these carefully, because they spell out your rights and restrictions for this doc. Any Code Components pulled out of this doc must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License. 📝
Table of Contents 🗂️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Motivation and Uniqueness of 464XLAT . . . . . . . . . . . . . 4
4. Network Architecture . . . . . . . . . . . . . . . . . . . . . 4
4.1. Wireline Network Architecture . . . . . . . . . . . . . . 4
4.2. Wireless 3GPP Network Architecture . . . . . . . . . . . . 5
5. Applicability . . . . . . . . . . . . . . . . . . . . . . . . 6
5.1. Wireline Network Applicability . . . . . . . . . . . . . . 6
5.2. Wireless 3GPP Network Applicability . . . . . . . . . . . 7
6. Implementation Considerations . . . . . . . . . . . . . . . . 7
6.1. IPv6 Address Format . . . . . . . . . . . . . . . . . . . 7
6.2. IPv4/IPv6 Address Translation Chart . . . . . . . . . . . 7
6.3. IPv6 Prefix Handling . . . . . . . . . . . . . . . . . . . 9
6.4. DNS Proxy Implementation . . . . . . . . . . . . . . . . . 9
6.5. CLAT in a Gateway . . . . . . . . . . . . . . . . . . . . 9
6.6. CLAT-to-CLAT Communications . . . . . . . . . . . . . . . 10
7. Deployment Considerations . . . . . . . . . . . . . . . . . . 10
7.1. Traffic Engineering . . . . . . . . . . . . . . . . . . . 10
7.2. Traffic Treatment Scenarios . . . . . . . . . . . . . . . 10
8. Security Considerations . . . . . . . . . . . . . . . . . . . 11
9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 11
10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11
10.1. Normative References . . . . . . . . . . . . . . . . . . . 11
10.2. Informative References . . . . . . . . . . . . . . . . . . 12
Appendix A. Examples of IPv4/IPv6 Address Translation . . . . . . 131. Introduction ✨
So IPv4 addresses are running out 😭 Once the unallocated pools are gone, it's going to be hard for lots of networks to hand out IPv4 addresses to end users.
This doc describes an IPv4-over-IPv6 solution, which is one of the ways to extend IPv4 service and encourage IPv6 deployment. 464XLAT is not a one-for-one replacement for full IPv4 functionality, bestie. It only supports IPv4 in the client-server model, where the server has a global IPv4 address. That means it's not fit for IPv4 peer-to-peer communication or inbound IPv4 connections. 🙈 It's built on IPv6 transport and it includes full any-to-any IPv6 communication 🦋
The 464XLAT architecture here uses IPv4/IPv6 translation standardized in [RFC6145] and [RFC6146]. It does not require DNS64 [RFC6147], because an IPv4 host can just send IPv4 packets, even packets to an IPv4 DNS server. Those get translated to IPv6 at the customer-side translator (CLAT) and back to IPv4 at the provider-side translator (PLAT). 464XLAT networks may use DNS64 [RFC6147] to enable single stateful translation [RFC6146] instead of the 464XLAT double translation where possible. The whole point is to push the IPv6 transition forward by making IPv4 services reachable across IPv6-only networks, and by giving IPv6 and IPv4 connectivity to single-stack IPv4 or IPv6 servers and peers. Main character energy 👑
2. Terminology 📚
PLAT is the provider-side translator (XLAT) that complies with [RFC6146]. It translates N:1 global IPv6 addresses to global IPv4 addresses, and vice versa. 🌈
CLAT is the customer-side translator (XLAT) that complies with [RFC6145]. It algorithmically translates 1:1 private IPv4 addresses to global IPv6 addresses, and vice versa. The CLAT function applies to a router or an end-node like a mobile phone. The CLAT should perform IP routing and forwarding, so packets can go through the stateless translation even when it's an end-node. A CLAT that's a common home router or a wireless Third Generation Partnership Project (3GPP) router is expected to perform gateway functions, like acting as a DHCP server and DNS proxy for local clients. 🏠
Here's the spicy part 🌶️ The CLAT uses different IPv6 prefixes for CLAT-side and PLAT-side IPv4 addresses. Because of that, it does not comply with the sentence "Both IPv4-translatable IPv6 addresses and IPv4-converted IPv6 addresses SHOULD use the same prefix." in Section 3.3 of [RFC6052]. And the CLAT does not facilitate communication between a local IPv4-only node and an IPv6-only node on the Internet. 💀
3. Motivation and Uniqueness of 464XLAT 💜
Here's why 464XLAT is worth it and what makes it special ✨
- 464XLAT has minimal IPv4 resource requirements, and it gets maximum IPv4 efficiency through statistical multiplexing. 🍓
- No new protocols are required, so deployment is quick 🚀
- IPv6-only networks are simpler, and therefore less expensive to operate, than dual-stack networks. 💰
- 464XLAT has consistent native IP-based monitoring and traffic engineering. Capacity-planning techniques can be applied without the indirection or obfuscation of a tunnel. 🫶
4. Network Architecture 🌸
Examples of 464XLAT architectures are shown in the figures in the following sections. 🎀
The Wireline Network Architecture works when there are clients behind the CLAT, no matter what kind of access service it is. Think fiber to the home (FTTH), Data Over Cable Service Interface Specification (DOCSIS), or WiFi.
The Wireless 3GPP Network Architecture works when a client terminates the wireless access network and maybe acts as a router with tethered clients. 📱
4.1. Wireline Network Architecture 🏡
Okay so the private IPv4 host in this diagram can reach global IPv4 hosts through translation on both the CLAT and the PLAT. The IPv6 host, on the other hand, can reach other IPv6 hosts on the Internet directly, with no translation. That means the Customer Premises Equipment (CPE) / CLAT can not only act as a CLAT, but also as an IPv6 native router for native IPv6 traffic. 🔥 In this diagram, the v4p host behind the CLAT has [RFC1918] addresses.
+------+
| v6 |
| host |
+--+---+
|
.---+---.
/ \
/ IPv6 \
| Internet |
\ /
`----+----'
|
+------+ | .---+---. .------.
| v6 +---+ +------+ / \ +------+ / \
| host | | | | / IPv6 \ | | / IPv4 \
+------+ +---+ CLAT +---+ Network +---+ PLAT +---+ Internet |
+--------+ | | | \ / | | \ /
| v4p/v6 +-+ +------+ `---------' +------+ `----+----'
| host | | |
+--------+ | +--+---+
+------+ | | v4g |
| v4p +---+ | host |
| host | | +------+
+------+ |
<- v4p -> XLAT <--------- v6 --------> XLAT <- v4g ->
v6 : Global IPv6
v4p : Private IPv4
v4g : Global IPv4
Figure 1: Wireline Network Topology4.2. Wireless 3GPP Network Architecture 📱✨
okay so on the UE (that's the phone, bestie 📱), the CLAT function gives the local network stack an [RFC1918] address and an IPv4 default route 💖. Apps can use that private IPv4 address to reach global IPv4 hosts, and translation happens on both the CLAT and the PLAT 🙌. Reaching IPv6 hosts (including the ones shown through DNS64 [RFC6147]) doesn't need the CLAT on the UE at all, which is so convenient 💅.
Tethering is another CLAT moment. Making a private IPv4 network for tethering through NAT44 and stateless translation on the UE is also an application of the CLAT 🦋.
+------+
| v6 |
| host |
+--+---+
|
.---+---.
/ \
/ IPv6 \
| Internet |
\ /
UE / Mobile Phone `---------'
+----------------------+ |
| +----+ | | .---+---. .------.
| | v6 +----+ +------+ / \ +------+ / \
| +----+ | | | / IPv6 PDP \ | | / IPv4 \
| +---+ CLAT +---+ Mobile Core +---+ PLAT +--+ Internet |
| | | | \ GGSN / | | \ /
| | +------+ \ ' +------+ `----+---'
| +-----+ | | `-------' |
| | v4p +---+ | +--+---+
| +-----+ | | | v4g |
+----------------------+ | host |
+------+
<- v4p -> XLAT <--------- v6 --------> XLAT <- v4g ->
v6 : Global IPv6
v4p : Private IPv4
v4g : Global IPv4
PDP : Packet Data Protocol
GGSN : Gateway GPRS Support Node
Figure 2: Wireless 3GPP Network Topology5. Applicability ✨
5.1. Wireline Network Applicability 🏠
when an Internet Service Provider (ISP) has IPv6 access service and provides 464XLAT, that ISP can hand end users outgoing IPv4 service across an IPv6 access network 🌈. The big payoff is that edge network growth isn't tied so tightly to scarce IPv4 addresses anymore 🔥.
If another ISP runs the PLAT, the edge ISP only has to deploy an IPv6 access network 💜. Not every ISP needs an IPv4 access network. They can move their access network to a simple, highly scalable IPv6-only setup, and that's iconic ⭐.
5.2. Wireless 3GPP Network Applicability 📶
at the time of writing, in April 2013, most mobile networks were compliant with Pre-Release 9 3GPP standards 🕰️. In Pre-Release 9 3GPP networks, Global System for Mobile Communications (GSM) and Universal Mobile Telecommunications System (UMTS) networks must signal and support both IPv4 and IPv6 Packet Data Protocol (PDP) attachments to reach IPv4 and IPv6 destinations [RFC6459]. Two address families means two PDPs, which is double the number needed for the old single-family status quo, IPv4 💀.
When an app connects to an IPv4 literal or an IPv4 socket that needs IPv4 connectivity, the CLAT on the UE gives it a private IPv4 address and an IPv4 default route to reference and bind to 🧚. Connections from the IPv4 interface get routed straight to the CLAT, then passed to the IPv6-only mobile network, heading for the PLAT 🚀. So, in short, the UE runs the CLAT, which does a stateless translation [RFC6145], but only when an IPv4-only case (like IPv4 literals or IPv4-only sockets) actually calls for it 🎀. The mobile network's PLAT does stateful translation [RFC6146] 💖.
464XLAT works with today's existing systems as much as it can 🫶. It's also compatible with existing network-based deep packet inspection solutions, like the 3GPP standardized Policy and Charging Control (PCC) [TS.23203] 🔍.
6. Implementation Considerations 🛠️
6.1. IPv6 Address Format 🔢
the IPv6 address format in 464XLAT is defined in Section 2.2 of [RFC6052] 💫.
6.2. IPv4/IPv6 Address Translation Chart 🗺️
this chart explains the address translation architecture, which combines stateful translation at the PLAT with stateless translation at the CLAT 🦋. The client on this chart gets an IPv6 prefix from a prefix delegation mechanism, like DHCPv6 Prefix Delegation (DHCPv6-PD) [RFC3633], so it has its own dedicated IPv6 prefix for translation 💜.
Destination IPv4 address
+----------------------------+
| Global IPv4 address |
+--------+ | assigned to IPv4 server |
| IPv4 | +----------------------------+
| server | Source IPv4 address
+--------+ +----------------------------+
^ | Global IPv4 address |
| | assigned to IPv4 PLAT pool |
| +----------------------------+
+--------+
| PLAT | Stateful XLATE(IPv4:IPv6=1:n)
+--------+
^
|
(IPv6 cloud)
Destination IPv6 address
+--------------------------------------------------------------+
| IPv4-embedded IPv6 address |
| defined in Section 2.2 of RFC 6052 |
+--------------------------------------------------------------+
Source IPv6 address
+--------------------------------------------------------------+
| IPv4-embedded IPv6 address |
| defined in Section 2.2 of RFC 6052 |
+--------------------------------------------------------------+
(IPv6 cloud)
^
|
+--------+
| CLAT | Stateless XLATE(IPv4:IPv6=1:1)
+--------+
^ Destination IPv4 address
| +----------------------------+
+--------+ | Global IPv4 address |
| IPv4 | | assigned to IPv4 server |
| client | +----------------------------+
+--------+ Source IPv4 address
+----------------------------+
| Private IPv4 address |
| assigned to IPv4 client |
+----------------------------+
Figure 3: Case of Enabling Only Stateless XLATE on CLAT6.3. IPv6 Prefix Handling 🧁
the CLAT has to keep track of two relevant IPv6 prefixes 🎀.
First up, the CLAT needs to know its own IPv6 prefixes 🏷️. The CLAT should acquire a /64 for the uplink interface, a /64 for all downlink interfaces, and a dedicated /64 prefix for sending and receiving statelessly translated packets 💖. If a dedicated /64 isn't available for translation from DHCPv6-PD [RFC3633], the CLAT may do NAT44 for all IPv4 LAN packets, so every LAN-originated IPv4 packet appears to come from a single IPv4 address. Those packets then get statelessly translated to one interface IPv6 address that the CLAT claims through the Neighbor Discovery Protocol (NDP) and defends with Duplicate Address Detection (DAD) 🛡️.
Second, the CLAT has to discover the PLAT-side translation IPv6 prefix, which is the destination the PLAT uses 🔭. The CLAT will use this prefix as the destination for all translation packets that need stateful translation to the IPv4 Internet 🌐. It may discover the PLAT-side translation prefix using [Discovery-Heuristic]. In the future, other mechanisms, like a new DHCPv6 option, will possibly be defined to communicate the PLAT-side translation prefix 🔮.
6.4. DNS Proxy Implementation 📖
the CLAT should implement a DNS proxy as defined in [RFC5625] 💌. An IPv4-only node behind the CLAT querying an IPv4 DNS server is undesirable, because every DNS lookup then needs both stateful and stateless translation 😩. The CLAT should set itself as the DNS server via DHCP or other means, and should proxy DNS queries for IPv4 and IPv6 LAN clients 🙌. Using the CLAT-enabled home router or UE as a DNS proxy is a normal consumer gateway function, and it simplifies the traffic flow so only IPv6 native queries cross the access network ✨. DNS queries from the client that don't go to the DNS proxy on the CLAT must be allowed, and they get translated and forwarded like any other IP traffic 🫧.
6.5. CLAT in a Gateway 🏡
the CLAT feature can live in a common home router or in a mobile phone that has a tethering feature 📡. Routers with a CLAT feature should also offer common router services, like DHCP of [RFC1918] addresses, DHCPv6, NDP with Router Advertisement, and DNS service 🍓.
6.6. CLAT-to-CLAT Communications 🤝
464XLAT is a hub and spoke architecture that's focused on enabling IPv4-only services over IPv6-only networks 🌸. Interactive Connectivity Establishment (ICE) [RFC5245] may be used to support peer-to-peer communication within a 464XLAT network 🦋.
7. Deployment Considerations 🚢
7.1. Traffic Engineering 🚦
even if the ISP for end users is different from the PLAT provider (for example, another ISP), that ISP can do traffic engineering independently from the PLAT provider 💅. Here's why:
- The ISP for end users can figure out the IPv4 destination address from the translated IPv6 packet header, so it can do traffic engineering based on that IPv4 destination address (for example, traffic monitoring for each IPv4 destination address, or packet filtering for each IPv4 destination address). Tunneling methods don't have this advantage, since they'd need deep packet inspection to process the inner IPv4 packet of the tunnel packet 🔍.
- If the ISP for end users can assign an IPv6 prefix greater than /64 to each subscriber, this 464XLAT architecture can separate the IPv6 prefix for native IPv6 packets from the XLAT prefixes for IPv4/IPv6 translation packets 🪄. That means the ISP can tell the types of packets apart ("native IPv6 packets" and "IPv4/IPv6 translation packets") and do traffic engineering based on the IPv6 prefix 👑.
7.2. Traffic Treatment Scenarios ✨
Okay so here's the tea on how each combo of connectivity gets treated in the 464XLAT architecture 💅🫶
+--------+-------------+-----------------------+-------------+
| Server | Application | Traffic Treatment | Location of |
| | and Host | | Translation |
+--------+-------------+-----------------------+-------------+
| IPv6 | IPv6 | End-to-End IPv6 | None |
+--------+-------------+-----------------------+-------------+
| IPv4 | IPv6 | Stateful Translation | PLAT |
+--------+-------------+-----------------------+-------------+
| IPv4 | IPv4 | 464XLAT | PLAT/CLAT |
+--------+-------------+-----------------------+-------------+
Traffic Treatment Scenarios💀 Note: 464XLAT double translation treatment will be stateless when a dedicated /64 is available for translation on the CLAT. Otherwise, the CLAT will have both stateful and stateless since it requires NAT44 from the LAN to a single IPv4 address and then stateless translation to a single IPv6 address.
8. Security Considerations 🔥
This part is serious, bestie, so pay attention 🥺 If you're implementing a PLAT, go read the security considerations in Section 5 of [RFC6146] ASAP.
If you're implementing a CLAT, go read Section 7 of [RFC6145] for its security considerations. The CLAT may comply with [RFC6092] too 🧚
9. Acknowledgements 🎀
The authors would like to thank JPIX NOC members, JPIX 464XLAT trial service members, Seiichi Kawamura, Dan Drown, Brian Carpenter, Rajiv Asati, Washam Fan, Behcet Sarikaya, Jan Zorz, Tatsuya Oishi, Lorenzo Colitti, Erik Kline, Ole Troan, Maoke Chen, Gang Chen, Tom Petch, Jouni Korhonen, Bjoern A. Zeeb, Hemant Singh, Vizdal Ales, Mark ZZZ Smith, Mikael Abrahamsson, Tore Anderson, Teemu Savolainen, Alexandru Petrescu, Gert Doering, Victor Kuarsingh, Ray Hunter, James Woodyatt, Tom Taylor, and Remi Despres for their helpful comments 🫶 We also would like to thank Fred Baker and Joel Jaeggli for their support 💖
10. References 📚
10.1. Normative References
[RFC6052] Bao, C., Huitema, C., Bagnulo, M., Boucadair, M., and X.
Li, "IPv6 Addressing of IPv4/IPv6 Translators", RFC 6052,
October 2010.
[RFC6145] Li, X., Bao, C., and F. Baker, "IP/ICMP Translation
Algorithm", RFC 6145, April 2011.
[RFC6146] Bagnulo, M., Matthews, P., and I. van Beijnum, "Stateful
NAT64: Network Address and Protocol Translation from IPv6
Clients to IPv4 Servers", RFC 6146, April 2011.10.2. Informative References
[Discovery-Heuristic]
Savolainen, T., Korhonen, J., and D. Wing, "Discovery of
the IPv6 Prefix Used for IPv6 Address Synthesis", Work
in Progress, March 2013.
[RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and
E. Lear, "Address Allocation for Private Internets",
BCP 5, RFC 1918, February 1996.
[RFC3633] Troan, O. and R. Droms, "IPv6 Prefix Options for Dynamic
Host Configuration Protocol (DHCP) version 6", RFC 3633,
December 2003.
[RFC5245] Rosenberg, J., "Interactive Connectivity Establishment
(ICE): A Protocol for Network Address Translator (NAT)
Traversal for Offer/Answer Protocols", RFC 5245,
April 2010.
[RFC5625] Bellis, R., "DNS Proxy Implementation Guidelines",
BCP 152, RFC 5625, August 2009.
[RFC6092] Woodyatt, J., "Recommended Simple Security Capabilities in
Customer Premises Equipment (CPE) for Providing
Residential IPv6 Internet Service", RFC 6092,
January 2011.
[RFC6147] Bagnulo, M., Sullivan, A., Matthews, P., and I. van
Beijnum, "DNS64: DNS Extensions for Network Address
Translation from IPv6 Clients to IPv4 Servers", RFC 6147,
April 2011.
[RFC6459] Korhonen, J., Soininen, J., Patil, B., Savolainen, T.,
Bajko, G., and K. Iisakkila, "IPv6 in 3rd Generation
Partnership Project (3GPP) Evolved Packet System (EPS)",
RFC 6459, January 2012.
[TS.23203] 3GPP, "Policy and charging control architecture", 3GPP
TS 23.203 10.7.0, June 2012.Appendix A. Examples of IPv4/IPv6 Address Translation 🧚✨
Here's a worked example of IPv4/IPv6 address translation in the 464XLAT architecture. Let's gooo 🚀
Say an end user gets an IPv6 prefix longer than /64 assigned to them, through something like DHCPv6-PD [RFC3633]. In that case, the CLAT can use a dedicated /64 out of that assigned IPv6 prefix 💜
Host & configuration value
+------------------------------+
| IPv4 server |
| [198.51.100.1] | IP packet header
+------------------------------+ +--------------------------------+
^ | Destination IP address |
| | [198.51.100.1] |
| | Source IP address |
| | [192.0.2.1] |
+------------------------------+ +--------------------------------+
| PLAT | ^
| IPv4 pool address | |
| [192.0.2.1 - 192.0.2.100] | |
| PLAT-side XLATE IPv6 prefix | |
| [2001:db8:1234::/96] | |
+------------------------------+ +--------------------------------+
^ | Destination IP address |
| | [2001:db8:1234::198.51.100.1] |
| | Source IP address |
| | [2001:db8:aaaa::192.168.1.2] |
+------------------------------+ +--------------------------------+
| CLAT | ^
| PLAT-side XLATE IPv6 prefix | |
| [2001:db8:1234::/96] | |
| CLAT-side XLATE IPv6 prefix | |
| [2001:db8:aaaa::/96] | |
+------------------------------+ +--------------------------------+
^ | Destination IP address |
| | [198.51.100.1] |
| | Source IP address |
| | [192.168.1.2] |
+------------------------------+ +--------------------------------+
| IPv4 client |
| [192.168.1.2/24] |
+------------------------------+
Delegated IPv6 prefix for client: 2001:db8:aaaa::/56Authors' Addresses 💌
Masataka Mawatari
Japan Internet Exchange Co., Ltd.
KDDI Otemachi Building 19F, 1-8-1 Otemachi,
Chiyoda-ku, Tokyo 100-0004
JAPAN
Phone: +81 3 3243 9579
EMail: mawatari@jpix.ad.jp
Masanobu Kawashima
NEC AccessTechnica, Ltd.
800, Shimomata
Kakegawa-shi, Shizuoka 436-8501
JAPAN
Phone: +81 537 22 8274
EMail: kawashimam@vx.jp.nec.com
Cameron Byrne
T-Mobile USA
Bellevue, Washington 98006
USA
EMail: cameron.byrne@t-mobile.com🌈 That's the whole doc, bestie. Iconic. 🦋
📦 where this page comes from
- ietf: rfc6877 2013-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms