RFC 6909
IPv4 Traffic Offload Selector Option for Proxy Mobile IPv6
RFC 6909: IPv4 Traffic Offload Selector Option for Proxy Mobile IPv6 🎀
okay bestie, let's start with the title block 💅 This is RFC 6909, a Standards Track document, which means it's an actual Internet standard and not just a vibe. It came out in April 2013 and is published under ISSN 2070-1721 🦋
The authors are S. Gundavelli, Ed. (Cisco), X. Zhou (ZTE Corporation), J. Korhonen (Renesas Mobile), G. Feige (no affiliation listed), and R. Koodli (Cisco). The title block doesn't list anything this RFC obsoletes or updates 🌸
Abstract ✨
okay so this spec defines a brand new mobility option called the IPv4 Traffic Offload Selector option, and it's for Proxy Mobile IPv6 🧚 The local mobility anchor and the mobile access gateway use it to negotiate an IPv4 traffic offload policy for a mobility session. Once they've agreed on that policy, the mobile access gateway can pick out some IPv4 traffic flows and offload them right there in the access network, instead of tunneling everything all the way back to the local mobility anchor in the home network 💖
Status of This Memo 🌈
This is an Internet Standards Track document 🎀
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, it got public review, and the Internet Engineering Steering Group (IESG) approved it for publication. If you want more on Internet Standards, check out Section 2 of RFC 5741 ✨
For the current status of this document, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc6909 💜
Copyright Notice 🔥
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. 🫶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 💅
Table of Contents 📚
1. Introduction ....................................................2
2. Conventions and Terminology .....................................4
2.1. Conventions ................................................4
2.2. Terminology ................................................4
3. Solution Overview ...............................................4
3.1. IPv4 Traffic Offload Selector Option .......................6
3.2. MAG Considerations .........................................8
3.3. LMA Considerations .........................................9
4. Protocol Configuration Variables ...............................11
5. IANA Considerations ............................................11
6. Security Considerations ........................................12
7. Acknowledgements ...............................................12
8. References .....................................................13
8.1. Normative References ......................................13
8.2. Informative References ....................................131. Introduction 🦋
okay so mobile operators keep expanding their coverage by putting different access technologies, like Wireless LAN, CDMA, and Long-Term Evolution (LTE), onto one shared IP mobility core 🌸 The Third Generation Partnership Project (3GPP) S2a Proxy Mobile IPv6 [TS23402] reference point is what the 3GPP system architecture uses to define how all of that interworks. In this setup, the mobile node's IP traffic always gets tunneled back from the mobile access gateway [RFC5213] in the access network to the local mobility anchor in the home network. And ngl, right now there's no mechanism for letting some of a subscriber's IP flows get offloaded in the access network 😭
With mobile data traffic growing exponentially, operators are looking for new ways to offload some IP traffic at the nearest access edge ✨ The offload is meant either for local service access in the access network, or for Internet offload through the access network when there's an Internet peering point. Not every IP flow needs to be routed back to the home network. Traffic that doesn't need IP mobility support can be offloaded at the mobile access gateway in the access network, and that keeps the mobile packet core running efficiently, which helps lower transport costs 💰 To figure out which IP flows should be offloaded, the local mobility anchor in the home network can deliver the IP flow policy to the mobile access gateway in the access network 🧚 Whether to offload is totally up to the operator's discretion. One operator might offload everything except traffic that needs QoS services, like Voice over IP. Another might only offload HTTP traffic 💜 This specification only covers matching IP traffic against a given flow selector, plus classifying IP traffic for offloading purposes. There's one limitation when it comes to encrypted traffic, though: IPsec-encrypted traffic that has no visibility into the application payload can't be selected for offload 🙈
This document defines a new mobility option, the IPv4 Traffic Offload Selector option (see Section 3.1), for Proxy Mobile IPv6 (PMIPv6) 🎀 The local mobility anchor and the mobile access gateway use it to negotiate an IPv4 traffic offload policy for a mobility session. That policy identifies the flow selectors that can be used to pick which flows get offloaded at the access edge. Because the mobile node's IP address topologically belongs to the home network, offloaded IPv4 traffic flows may need to be NAT [RFC2663] translated. Those offloaded flows won't get mobility support, because the NAT becomes the anchor point for them. But if the traffic is offloaded for local service access instead of Internet offload, NAT translation may not be needed, as long as the mobile access gateway is in the path for the return traffic. Whether to apply NAT translation can be decided by local configuration on the mobile access gateway 🌈 There are better ways to tackle the offload problem for IPv6, and the goal is to avoid creating a NAT66 requirement, so this specification does not address traffic offload support for IPv6 flows 🍓
2. Conventions and Terminology 💖
2.1. Conventions 🫶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 💅
2.2. Terminology 📚
All the mobility-related terms used in this document should be read as defined in the base Proxy Mobile IPv6 specifications [RFC5213] [RFC5844]. On top of those, this document uses the following terms ✨
IP Flow 🦋
IP flow [RFC5101] represents a set of IP packets that match a traffic selector (TS). The selector is typically based on the source IP address, destination IP address, source port, destination port, and other fields in upper-layer headers.
IP Traffic Offload 🌸
IP traffic offload is the approach of selecting specific IP flows and routing them through the access network instead of tunneling them to the home network. Offload can also happen between two access networks, for example moving some traffic from LTE access to WLAN access 🧚
okay that's the first chunk of the tea 🫖 more of this next, bestie 💜
3. Solution Overview ✨
Okay bestie, let's talk about how this whole thing actually works 🦋 Figure 1 shows a mobile access gateway (MAG) in an access network that has turned on IPv4 traffic offload for a mobility session 💅 The MAG decides what to offload based on the IPv4 traffic offload policy it negotiated with the local mobility anchor (LMA) in the home network. For example, all the HTTP flows might get offloaded right at the MAG, while every other flow for that session gets tunneled back to the LMA 🌸
The offloaded flows usually need NAT translation, and this spec doesn't put any limits on where the NAT function lives 🙈 It can be co-located with the MAG, or it can sit somewhere at the edge of the access network. If the NAT isn't on the MAG, the offloaded traffic has to get delivered across the local access network between the MAG and the NAT, like through a VLAN or a point-to-point link. How that delivery happens is totally outside the scope of this document 🤷♀️ And if the offloaded IPv4 flows are for local service access, and the reverse traffic from the local service device can be routed to the mobile node through the MAG, then the offloaded flows can go straight to a local service device ✨
The traffic selectors in the IPv4 traffic offload policy are what classify the traffic, so it knows what can be offloaded at the access network 🎀 Those parameters include source IP address, destination IP address, TCP/UDP port numbers, and other fields. The format for the IPv4 binary traffic selector is specified in Section 3.1 of [RFC6088] 💜
_----_
_( )_
:-----------------( Internet )---------------:
| (_ _) |
| '----' |
| |
: |
(IPv4 Traffic Offload Point) |
: |
| |
........................................................|....
| | |
+--------+ | +---------------------+ |
| Local | | | Services requiring | |
|Services| | | mobility, or service| |
+--------+ | | treatment | |
| | +---------------------+ |
| +---+ | |
| |NAT| | |
| +---+ | |
+-----| _----_ | |
+-----+ _( )_ +-----+ |
[MN]----| MAG |======( IP )======| LMA |----------
+-----+ (_ _) +-----+ Internet
'----'
.
.
[Access Network] . [Home Network]
..........................................................
Figure 1: IPv4 Traffic Offload Support at the MAGFigure 2 walks through the Proxy Mobile IPv6 signaling exchange between the MAG and the LMA for negotiating the IPv4 traffic offload selectors 🧚 The DHCP stuff and Router Advertisements on the access link aren't shown, because that's not the main focus here 🙈 The IPv4 Traffic Selector option in the Proxy Binding Update is how the MAG asks the LMA for the IPv4 traffic offload policy, and that's the whole vibe 💖
MN MAG(NAT) LMA
|------>| | 1. Mobile Node Attach
| |------->| 2. Proxy Binding Update (IPv4TS)
| |<-------| 3. Proxy Binding Acknowledgement (IPv4TS)
| |========| 4. Tunnel/Route Setup
| + | 5. Installing the traffic offload rules
|------>| | 6. IPv4 packet from mobile node
| + | 7. Offload rule applied (Tunnel/offload)
| | |
Figure 2: Exchange of IPv4 Traffic Offload Selectors3.1. IPv4 Traffic Offload Selector Option
Okay so here's the new mobility option: the IPv4 Traffic Offload Selector option (53) 🎀 It gets used in Proxy Binding Update (PBU) and Proxy Binding Acknowledgement (PBA) messages that go between a mobile access gateway and a local mobility anchor. Its whole job is carrying the IPv4 traffic offload policy, which says which IPv4 traffic flow selectors the MAG can use to enforce that offload policy 🦋
The alignment requirement for this option is 4n. 📏
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Traffic Selector Sub-option ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3: IPv4 Traffic Offload Selector OptionLet's break down each field 💅
Type
- The value is
53. 🍓
Length
- This is an 8-bit unsigned integer that tells you the length in octets of the option, excluding the type and length fields. 🧮
Offload Mode (M) Flag
- This field tells you the offload mode. 🌈
- If the (M) flag value is set to a value of (0), that means the IPv4 flow(s) matching the traffic selectors in the Traffic Selector sub-option [RFC6089] and associated with that mobility session have to be offloaded at the mobile access gateway. Every other IPv4 flow for that session that doesn't match the selectors has to be tunneled to the local mobility anchor. 🚀
- If the (M) flag value is set to a value of (1), that means all the IPv4 flows for that mobility session except the ones matching the traffic selectors have to be offloaded at the mobile access gateway. The flows that do match the selectors have to be tunneled back to the local mobility anchor. 🔄
Reserved
- This field is unused for now. 💤 The value MUST be initialized to 0 by the sender and MUST be ignored by the receiver. 🫶
Traffic Selector Sub-option
- This sub-option has the parameters used to match packets for a specific flow binding. 🎯
- It's optional when the IPv4 Traffic Selector option is carried in a Proxy Binding Update message, but it's mandatory when the option is carried in a Proxy Binding Acknowledgement message. 👑
- The format of the Traffic Selector sub-option is defined in Section 4.2.1.4 of [RFC6089]. 📚
- It includes a TS Format field, which identifies the format of the flow specification inside that sub-option. The values for that field are defined in Section 3 of [RFC6088] and repeated here for completeness 💜
- When the TS Format field is set to (1), the format that follows is the IPv4 binary traffic selector specified in Section 3.1 of [RFC6088], and support for that is mandatory for this specification. 🔥
- The text in this section takes precedence over what's specified in [RFC6088] and [RFC6089]. Main character energy 👑
The TS Format values are:
1: IPv4 binary traffic selector
2: IPv6 binary traffic selector (not used by this
specification)3.2. MAG Considerations ✨
okay so this section is for the mobile access gateway (MAG) 🫶 here's the full tea:
- if the MAG has IPv4 traffic offload turned on, it slaps the IPv4 Traffic Offload Selector option (Section 3.1) into the Proxy Binding Update it sends to the local mobility anchor (LMA) 🦋 it can also optionally suggest a specific offload policy, which is giving main character energy
- the MAG MAY skip proposing a policy and just ask the LMA to pick one 🙈 in that case the option has no Traffic Selector sub-option (see Section 3.1), and the (M) flag (see Section 3.1) MUST be set to (0). so basically, sending the option with no Traffic Selector sub-option just means "hey, I'm not proposing anything, could you please hand me the offload policy?" 🥹
- the MAG MAY propose a specific IPv4 traffic offload policy by putting the Traffic Selector sub-option in the IPv4 Traffic Offload Selector option (see Section 3.1). how the MAG actually gets the mobile node's IPv4 traffic offload policy is out of scope for this doc, so that's a whole other vibe 💅 when the policy is in the Proxy Binding Update, it's just a proposal, and the LMA can override it with its own policy or agree to it ✨ the policy has to be translated into selectors that match the mobile node's IP flows, and those selectors have to ride along in the Traffic Selector sub-option. the Traffic Selector sub-option MUST be built as described in Section 4.2.1.4 of [RFC6089] 🎀 that sub-option has a TS Format field, which tells you the format of the flow spec inside it, and the values for that field plus the matching message format are defined in Section 3.1 of [RFC6088] 🧚 and the Section 3.1 considerations about setting the Offload Mode (M) flag still apply, periodt 💖
- when the MAG sends a Proxy Binding Update for a Binding Lifetime Extension or a Binding De-Registration, it SHOULD copy the IPv4 Traffic Offload Selector option from the initial Proxy Binding Update 🌸 and the considerations from Sections 6.9.1.3 and 6.9.1.4 of [RFC5213] MUST be applied 💅
- if the MAG is NOT set up for IPv4 traffic offload as this spec describes, but the Proxy Binding Acknowledgement it gets back has the IPv4 Traffic Offload Selector option, the MAG MUST ignore that option and process the rest of the message as per [RFC5213] 🙈 no drama, just skip it
- if the Proxy Binding Acknowledgement has no IPv4 Traffic Offload Selector option, that means the LMA did NOT turn on IPv4 traffic offload for that mobility session 💀 after accepting that ack, the MAG SHOULD NOT enable IPv4 traffic offload for that session
- if the Proxy Binding Acknowledgement DOES have the IPv4 Traffic Offload Selector option, the MAG SHOULD enable IPv4 traffic offload for that session ✨ it has to provision the data plane using the flow selectors in the Traffic Selector sub-option 🔥 the IPv4 flows that match those selectors have to be offloaded, or tunneled back to the LMA, depending on the value of the Offload Mode (M) flag (see Section 3.1) 🦋
3.3. LMA Considerations 🌈
now the LMA's turn, bestie 👑
- if the Proxy Binding Update doesn't include the IPv4 Traffic Offload Selector option (Section 3.1), the LMA MUST NOT enable IPv4 traffic offload for that mobility session 🙅♀️ and the Proxy Binding Acknowledgement it sends back MUST NOT contain the IPv4 Traffic Offload Selector option. no option in, no option out, that's the rule 💜
- if the Proxy Binding Update has the IPv4 Traffic Offload Selector option but the LMA isn't set up for IPv4 traffic offload, the LMA will ignore the option and process the rest of the message as per [RFC5213] ✨ this has no effect on the rest of the protocol, so nothing breaks, lowkey iconic 🧚
- if the Proxy Binding Update has the IPv4 Traffic Offload Selector option AND the LMA is set up to support IPv4 traffic offload, the LMA MUST enable IPv4 traffic offload for that session 🔥 the Proxy Binding Acknowledgement that goes out in response MUST include the IPv4 Traffic Offload Selector option. here's how the LMA builds that option 💅
- the LMA can get the offload policy from its local configuration store, or from a network function like AAA (Authentication, Authorization, and Accounting) or PCRF (Policy and Charging Rule Function) 🌸 the policy has to be turned into selectors that match the mobile node's IP flows, and those selectors have to be carried in the Traffic Selector sub-option. the Traffic Selector sub-option MUST be built as specified in Section 4.2.1.4 of [RFC6089] 🎀 and the Section 3.1 considerations about the Offload Mode (M) flag apply here too 💖
- if the Proxy Binding Update already proposes a specific IPv4 traffic offload policy in the Traffic Selector sub-option [RFC6089], the LMA MAY agree by putting that same policy in the Proxy Binding Acknowledgement 🫶 which means the LMA is cool with what the MAG asked for. the LMA MAY also override that request with a different IPv4 traffic offload policy it wants the MAG to enforce for that session. it's entirely up to the LMA's policy config 🧚
- the IPv4 traffic offload policy sent to the MAG has to be specific to the mobility session identified by the Mobile Node Identifier option [RFC5213] 🦋 the offload policy MUST be specific to the mobile node's application traffic. the traffic selectors have to match ONLY that mobile node's application traffic and MUST NOT match any other mobile node's IP traffic 🙈 and control-plane traffic like DHCP, Neighbor Discovery (ND), or any other IP traffic used for IP address configuration, mobility management, or other control-plane functions MUST NOT be subject to offload. hard boundary, no exceptions, we don't touch the plumbing 🛑
- the LMA MUST NOT change the mobile node's offload policy in the middle of a mobility session, as long as the mobile node keeps attaching to the MAG that negotiated the policy 💅 BUT when the mobile node does an inter-MAG handover, the new MAG might not be able to do IP traffic offload, so the policy may change in that case 🌈 which is why the IPv4 Traffic Selector option with the Traffic Selector sub-option sent during the initial mobility signaling MUST be the same as the one sent in the mobility signaling for lifetime extension from that same MAG. consistency is everything, no cap 💖
4. Protocol Configuration Variables ⚙️
this spec defines one configuration variable that controls the IPv4 traffic offload support feature 🎀 it's internal to the system, so it has zero bearing on interoperability between different implementations, which is a relief honestly 🫶
the mobility entities (the LMA and the MAG) have to let system management configure these variables, and the configured values have to survive server reboots and service restarts 🔥
EnableIPv4TrafficOffloadSupport
This flag tells you whether IPv4 traffic offload support needs to be enabled 💜 the variable is available on BOTH the MAG and the LMA. the default value is (0), which means IPv4 traffic offload support is disabled by default 🙈
- when this flag is set to (1) on the MAG, the MAG has to enable IPv4 traffic offload support for ALL mobility sessions 🦋 it does that by specifically requesting the IPv4 traffic offload policy from the LMA, which means including the IPv4 Traffic Offload Selector option in the Proxy Binding Update. if the flag is (0), the MAG has to disable IPv4 traffic offload support for ALL mobility sessions 💀
- similarly, when this flag is set to (1) on the LMA, the LMA has to enable IPv4 traffic offload support ✨ if the LMA chooses to enable it when there's an offload policy specified for a mobile node, it has to deliver that policy to the MAG by including the IPv4 Traffic Offload Selector option in the Proxy Binding Acknowledgement message 🧚
5. IANA Considerations 📝
per this spec, IANA has assigned a brand new mobility option: the IPv4 Traffic Offload Selector option (53) 🌈 it's described in Section 3.1 🎀 and its Type value was assigned from the SAME numbering space used for the other mobility options [RFC6275] 🫶 which is the kind of organized energy I respect 👑
6. Security Considerations 🔒✨
okay bestie, security time 🫶 The IPv4 Traffic Offload Selector option defined here is for use in Proxy Binding Update and Proxy Binding Acknowledgement messages. It rides along like any other mobility header option, as specified in [RFC5213]. So it inherits [RFC5213]'s security guidelines and doesn't need any extra security considerations. Carrying IPv4 traffic offload selectors does not introduce any new security vulnerabilities. slay 💅
When IPv4 traffic offload support is enabled for a mobile node, the mobile access gateway selectively offloads some of the mobile node's IPv4 traffic flows to the access network. Typically these offloaded flows get NAT translated, which brings along certain vulnerabilities that are common to any NAT deployment 🙈 These vulnerabilities and the related considerations are well documented in the NAT specification [RFC2663]. There are no additional considerations beyond what the NAT specifications already document, and nothing here is unique to this document's approach. ngl that's a relief 🌸
The mobile node's home network may have firewalls and other security devices to guard against threats 🛡️ When IPv4 traffic offload support is enabled, it can expose the mobile node to some security risks in the access network. This threat can be mitigated by deploying security features in both the access network and the home network. Defense in depth, periodt 👑
When IPv4 traffic offload support is enabled for a mobile node, some IP flows go through the home network and some other IP flows are routed through the access network. This can add some complexity when you want to do diagnostics or monitoring on user traffic 💀 The diagnostic tools you use have to be aware of the offload policy that is enabled in the network, or they'll be lost.
7. Acknowledgements 🫶🎀
The authors want to thank Ahmad Muhanna, Basavaraj Patil, Carlos Bernardos, Eric Voit, Frank Brockners, Hidetoshi Yokota, Marco Liebsch, Mark Grayson, Pierrick Seite, Ryuji Wakikawa, Steve Wood, Barry Leiba, Sean Turner, Pete Resnick, Wesley Eddy, Mary Barnes, Vincent Roca, Ralph Droms, Scott Bradner, Stephen Farrell, Adrian Farrel, Benoit Claise, and Brian Haberman for all the reviews and discussions about IPv4 traffic offload. Iconic group of people, honestly 🦋✨
8. References 📚
8.1. Normative References 💜
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC5213] Gundavelli, S., Leung, K., Devarapalli, V., Chowdhury, K.,
and B. Patil, "Proxy Mobile IPv6", RFC 5213, August 2008.
[RFC5844] Wakikawa, R. and S. Gundavelli, "IPv4 Support for Proxy
Mobile IPv6", RFC 5844, May 2010.
[RFC6088] Tsirtsis, G., Giarreta, G., Soliman, H., and N. Montavont,
"Traffic Selectors for Flow Bindings", RFC 6088,
January 2011.
[RFC6089] Tsirtsis, G., Soliman, H., Montavont, N., Giaretta, G.,
and K. Kuladinithi, "Flow Bindings in Mobile IPv6 and
Network Mobility (NEMO) Basic Support", RFC 6089,
January 2011.
[RFC6275] Perkins, C., Johnson, D., and J. Arkko, "Mobility Support
in IPv6", RFC 6275, July 2011.8.2. Informative References 🌈
[RFC2663] Srisuresh, P. and M. Holdrege, "IP Network Address
Translator (NAT) Terminology and Considerations",
RFC 2663, August 1999.
[RFC5101] Claise, B., "Specification of the IP Flow Information
Export (IPFIX) Protocol for the Exchange of IP Traffic
Flow Information", RFC 5101, January 2008.
[TS23402] 3GPP, "Architecture enhancements for non-3GPP accesses",
2010.Authors' Addresses 🧚
Sri Gundavelli (editor)
Cisco
170 West Tasman Drive
San Jose, CA 95134
USA
EMail: sgundave@cisco.com
Xingyue Zhou
ZTE Corporation
No.68 Zijinghua Rd
Nanjing
China
EMail: zhou.xingyue@zte.com.cn
Jouni Korhonen
Renesas Mobile
Porkkalankatu 24
Helsinki FIN-00180
Finland
EMail: jouni.nospam@gmail.com
Gaetan Feige
Cisco
France
EMail: gfeige@cisco.com
Rajeev Koodli
Cisco
3650 Cisco Way
San Jose, CA 95134
USA
EMail: rkoodli@cisco.com📦 where this page comes from
- ietf: rfc6909 2013-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms