RFC 7040
Public IPv4-over-IPv6 Access Network
RFC 7040: Public IPv4-over-IPv6 Access Network 🎀
okay bestie, this one is all about Public 4over6 🦋. It's an IETF-made idea for giving people IPv4 internet over an IPv6-only access network, using real global IPv4 addresses. Here's the title-block tea 🫶:
- Who wrote it: Y. Cui, J. Wu, and P. Wu from Tsinghua University, plus O. Vautrin from Juniper Networks and Y. Lee from Comcast.
- Category: Informational, so it's published for information and isn't a standards-track spec 📚
- Date: November 2013
- ISSN: 2070-1721
- Obsoletes and updates: the title block doesn't list anything it obsoletes or updates 💅
Internet Engineering Task Force (IETF) Y. Cui
Request for Comments: 7040 J. Wu
Category: Informational P. Wu
ISSN: 2070-1721 Tsinghua University
O. Vautrin
Juniper Networks
Y. Lee
Comcast
November 2013Abstract
okay so the abstract is giving main character energy ✨. Public 4over6 gives people IPv4 internet access over an IPv6 access network, and it uses global IPv4 addresses 🌸. It was developed in the IETF and it's already in use in some real deployments, but it's not recommended for new ones 💀. If you're doing something similar in the future, go for Lightweight 4over6 instead 🧚.
Under the hood it follows the Hub and Spoke softwire model and uses an IPv4-in-IPv6 tunnel to carry IPv4 packets across the IPv6 access network 🔥. Two-way IPv4 traffic works because every end user gets their own global non-shared IPv4 address, and the border relay keeps an IPv4-to-IPv6 address binding for each one 👑. The whole goal is to keep IPv4 services running for users, like Internet Content Providers (ICPs) and friends, while an operator moves its access network to IPv6-only 🫶.
Status of This Memo
this section is super important because it says what kind of document this is 🙈. It is not an Internet Standards Track specification. It's published for informational purposes only 📚.
It's a product of the Internet Engineering Task Force (IETF) 🌈 and it reflects what the IETF community agreed on. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every IESG-approved document is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 if you want the details 🤓.
For the latest status, errata, and feedback info, go to http://www.rfc-editor.org/info/rfc7040 🍓.
Copyright Notice
okay the legal bit 💅. Copyright (c) 2013 IETF Trust and the persons identified as the document authors, all rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which are at http://trustee.ietf.org/license-info and were in effect on the publication date. Please actually read them, because they explain your rights and restrictions. Code components pulled from this document must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes ⚖️.
Table of Contents
1. Introduction ....................................................2
2. Terminology .....................................................4
3. Scenario and Use Cases ..........................................4
4. Public 4over6 Address Provisioning ..............................6
4.1. Basic Provisioning Steps ...................................6
4.2. Public IPv4 Address Allocation .............................7
5. 4over6 CE Behavior ..............................................7
6. 4over6 BR Behavior ..............................................8
7. Fragmentation and Reassembly ....................................9
8. DNS .............................................................9
9. Security Considerations ........................................10
10. Contributors ..................................................11
11. References ....................................................12
11.1. Normative References .....................................12
11.2. Informative References ...................................121. Introduction ✨
okay so here's the setup 🎀. When operators move their access network to IPv6-only, they still have to keep giving users IPv4 services so people can reach IPv4 content 😭. IPv4 connectivity is needed to talk to the IPv4-only Internet 🌐. This doc describes Public 4over6, which gives IPv4 connectivity over a native IPv6-only access network. The memo focuses on how Public 4over6 elements talk to each other and on the deployment architecture 💜.
Public 4over6 is actively deployed in some places, especially China Next Generation Internet (CNGI) and China Education and Research Network 2 (CERNET2). It's not recommended for new deployments though 💀. Writing it down is meant to help users and operators of existing deployments, plus anyone reading other IPv4-over-IPv6 documents 🧚.
Beyond Public 4over6, the IETF is working on a more generic option called Lightweight 4over6 [SOFTWIRE-LW46]. That one is classified as a binding approach in the Unified IPv4-in-IPv6 Softwire Customer Premises Equipment (CPE) [SOFTWIRE-CPE] 🔥. Lightweight 4over6 covers both sharing and non-sharing of global IPv4 addresses in the Hub and Spoke model. Future deployments should use [SOFTWIRE-LW46] 👑.
Public 4over6 uses the IPv4-in-IPv6 tunnel technique from [RFC2473], which lets IPv4 datagrams cross native IPv6 networks 🦋. IPv4 nodes connect to the Tunnel Entry-Point Node and the Tunnel Exit-Point Node so they can talk over the IPv6-only network. So ISPs can run an IPv6-only infrastructure instead of a full dual-stack network, and they don't have to spread scarce IPv4 address resources across the whole network 🌸.
This mechanism is all about full end-to-end transparency for the user side ✨. Global IPv4 addresses are expected to be given to end users, so carrier-side address translation can be skipped 🙈. Global non-shared IPv4 addresses are also preferred over shared ones, so user-side address translation isn't needed either 💅. This matters a lot for users who need to run applications on an IP protocol other than TCP and UDP (for example, IPsec or L2TP) or on certain well-known TCP/UDP ports (for example, HTTP or SMTP) 😭. For ISPs that can actually provision non-shared unique IPv4 addresses, this mechanism is a pure, suitable solution 🍓.
Flexibility is another big focus 💖. Public 4over6 lets the IPv4 and IPv6 address architectures be totally independent, because the end user's IPv4 address isn't embedded in its IPv6 address. That means IPv4 address planning has no effect on IPv6 address planning 🧚. Operators can manage their IPv4 address resources in a flat, centralized way. This does require that the tunnel concentrator [RFC4925] keep the binding between an IPv4 address and an IPv6 address, which means it keeps per-subscriber binding state 🔥.
Public 4over6 follows the Hub and Spoke softwire model [RFC4925] and uses IPv4-in-IPv6 tunneling as its basic data-plane method 👑. Global non-shared IPv4 addresses are allocated from the ISP to end hosts or CPEs over an IPv6 network 🌈. At the same time, the tunnel concentrator keeps the binding between the allocated IPv4 address and the end user's IPv6 address so it can do the encapsulation 🎀.
2. Terminology 💅
here are the key terms, bestie 🫶:
- Public 4over6: a per-subscriber, stateful IPv4-in-IPv6 tunnel mechanism. It supports two-way communication between the global IPv4 Internet and IPv4 hosts or customer networks through an IPv6 access network, using IPv4-in-IPv6 tunneling [RFC2473] and global IPv4 address allocation over IPv6. "Public" means the allocated IPv4 address is globally routable 🌍.
- Full IPv4 address: an IPv4 address that isn't shared by multiple users. The user holding it has full access to all the available TCP/UDP ports, including the well-known ones 🔓.
- 4over6 Customer Edge (CE): a device that acts as the Customer Edge equipment in a Public 4over6 environment. A 4over6 CE can be a dual-stack capable host or a dual-stack CPE device, and both have a tunnel interface for IPv4-in-IPv6 encapsulation 🎀. In the host case, the host runs both IPv4 and IPv6 stacks but its uplink is IPv6 only. In the CPE case, the CPE has an IPv6 interface facing the ISP network and an IPv4 or dual-stack interface facing the customer network, and hosts on the customer network can be IPv4 only or dual stack 🏠.
- 4over6 Border Relay (BR): a router at the edge of the operator's IPv6 access network that supports IPv4-in-IPv6 tunnel termination. A 4over6 BR is a dual-stack router that connects to both the IPv6 access network and the IPv4 Internet. It can also act as a DHCPv4-over-IPv6 [DHCPv4-IPv6] server or relay to assign and hand out global IPv4 addresses to 4over6 CEs 🧚.
more of the RFC is coming in part 2, so stay tuned, bestie 💖🦋
3. Scenario and Use Cases 🦋
Okay so picture the general Public 4over6 setup 🌸. Users in an IPv6 network get IPv6 as their native service. Some users are end hosts that face the ISP network directly, and others live in private networks behind CPEs, like a home LAN or an enterprise network, etc. The ISP network is IPv6 only and not dual stack, which means the ISP cannot give anyone native IPv4 service 😭. To still support legacy IPv4 transport, some routers on the carrier side are dual stack and connect to the IPv4 Internet. These routers act as 4over6 BRs, and network users who need IPv4 connectivity get it through them ✨.
+-------------------------+
| IPv6 ISP Network |
| |
+------+ |
|4over6|Host +-------+ +-----------+
| CE |=================| | | |
+------+ | | | |
| |4over6 | | IPv4 |
+--------------+ +------+ IPv4-in-IPv6 | BR |---| Internet |
| Customer | |4over6| | | | |
| Private IPv4 |--| CE |=================| | | |
| Network | | |CPE +-------+ +-----------+
+--------------+ +------+ |
| |
| |
+-------------------------+
Figure 1: Public 4over6 ScenarioPublic 4over6 fits a bunch of different use cases 💖. If an ISP is moving to IPv6 but still has loads of global IPv4 addresses, it can deploy Public 4over6 to give all its customers transparent IPv4 service 🍓. If the ISP doesn't have enough IPv4 addresses, it can deploy Dual-Stack Lite [RFC6333] as its basic IPv4-over-IPv6 service. Dual-Stack Lite can be paired with Public 4over6 as a value-added service, which fixes the service degradation caused by the Carrier Grade NAT (CGN) 🙌. An IPv4 application server is the classic high-end user of Public 4over6, and getting a full, global IPv4 address is a huge win there. It's also important for Internet Content Providers (ICPs) making the move to IPv6 👑:
- The DNS registration can be direct, using a dedicated address;
- Accessing the application service can be straightforward, with no translation involved;
- There will be no need to provide NAT traversal mechanisms for incoming traffic, and no special handling is required for the well-known TCP/UDP ports.
4. Public 4over6 Address Provisioning 🎀
4.1. Basic Provisioning Steps
Figure 2 shows the basic provisioning steps for Public 4over6 🧚.
4over6 DHCPv6 4over6 DHCPv4
CE Server BR Server
|Assign IPv6 Addr/Pref +| | |
| BR's IPv6 Addr Info | | |
|<----------------------| | |
| DHCPv6/Other | | |
WAN | |
IPv6 Configure | |
| | |
| Assign Public IPv4 Addr (DHCPv4 over v6/Static Conf) |
|<--------------------------------------|<-------------|
| | IPv4-IPv6 |
| | Binding SYN |
Tunnel |
IPv4 Configure Binding Update
| |
| IPv4-in-IPv6 Tunnel |
|<------------------------------------->|
| |
Figure 2: Public 4over6 Address ProvisioningHere are the main steps 💅:
- IPv6 address/prefix is provisioned to 4over6 CE, along with knowledge of 4over6 BR's IPv6 address, using DHCPv6 or other means.
- 4over6 CE configures its WAN interface with a globally unique IPv6 address, which is a result of IPv6 provisioning, including DHCPv6, Stateless Address Autoconfiguration (SLAAC), or manual configuration.
- IPv4 address is provisioned to 4over6 CE by DHCPv4 over IPv6 or static configuration.
- 4over6 BR obtains the IPv4 and IPv6 addresses of the 4over6 CE using information provided by the DHCPv4 server.
- 4over6 CE configures its tunnel interface as a result of IPv4 provisioning.
- 4over6 BR updates the IPv4-IPv6 address-binding table according to the address-binding information acquired from the DHCPv4 server.
4.2. Public IPv4 Address Allocation
Usually each CE gets one global IPv4 address 💜. But sometimes a CE needs an IPv4 prefix instead, and the key problem then is how to provision IPv4 addresses over IPv6 networks 🤔.
There are two options: DHCPv4 over IPv6, and static configuration. Public 4over6 supports both 🌈. DHCPv4 over IPv6 carries DHCPv4 messages inside IPv6 rather than IPv4, so the DHCPv4 process can run over an IPv6 network between the BR and the relevant CE. [DHCPv4-IPv6] describes the DHCP protocol extensions needed for this. With static configuration, Public 4over6 users and ISP operators negotiate ahead of time to authorize the IPv4 address(es). After that, the user configures the tunnel interface and the ISP configures the address binding 🫶.
Regular users would probably go with DHCPv4 over IPv6, but static configuration is especially useful in two situations: application servers, which need a stable IPv4 address, and enterprise networks, which usually need an IPv4 prefix rather than a single address 💀. (Heads up, DHCPv4 does not support prefix allocation 🙈.)
5. 4over6 CE Behavior 🌸
A CE gets its IPv6 before the Public 4over6 process starts, and it also learns the BR's IPv6 address beforehand ✨. That BR address can be configured in a few ways: out-of-band, by manual configuration, or through a DHCPv6 option. For interoperability, the CE element implements the AFTR-Name DHCPv6 option defined in [RFC6334] 👑.
A CE supports DHCPv4 over IPv6 [DHCPv4-IPv6] so it can dynamically get an IPv4 address over IPv6 and assign it to the IPv4-in-IPv6 tunnel interface 🦋. The CE treats the BR as its DHCPv4-over-IPv6 server/relay, which it uses to get its global IPv4 address allocation. The CE learned the BR's IPv6 address as described above.
A CE also supports static configuration of the tunnel interface 🍓. When it's a prefix being provisioned, the tunnel interface gets the well-known IPv4 address defined in Section 5.7 of [RFC6333], not an address from the prefix. If the CE has multiple IPv6 addresses on its WAN interface, it uses one of them for DHCPv4 over IPv6 or for negotiating static configuration. Then it uses that same IPv6 address for data-plane encapsulation 💅.
A CE does IPv4-in-IPv6 encapsulation and decapsulation on the tunnel interface 🧚. When it sends an IPv4 packet, it encapsulates it with the 4over6 BR's IPv6 address as the IPv6 destination address and its own IPv6 address as the IPv6 source address. Decapsulation on the 4over6 CE is simple: when an IPv4-in-IPv6 packet arrives, the CE just strips the IPv6 header and then either hands the packet to a local upper layer or forwards it to the customer network based on the IPv4 destination address 🫶.
A CE runs a regular IPv4 Network Address and Port Translation (NAPT) for its customer network when it's provisioned with one single IPv4 address 💜. In that case, the IPv4 address assigned to the tunnel interface becomes the external IPv4 address of the NAPT. The CE then does IPv4 private-to-public translation before encapsulating packets from the customer network, and IPv4 public-to-private translation after decapsulating IPv4-in-IPv6 packets 🌈.
IPv4 NAPT isn't needed when the CE gets an IPv4 prefix. In that case, detailed customer network planning is out of scope for this document 🙈.
The 4over6 CE supports backward compatibility with DS-Lite 🎀. A CE can use the well-known IPv4 address for the Basic Bridging BroadBand (B4) element [RFC6333] and switch to Dual-Stack Lite for IPv4 communications if it can't get a global IPv4 address from the DHCPv4 server. This could happen if the DHCPv4-over-IPv6 process fails, or if the DHCPv4 server refuses to allocate a global IPv4 address to it, etc. 😭
6. 4over6 BR Behavior 👑
The 4over6 BR keeps track of the bindings between the CE IPv6 address and the CE IPv4 address (prefixes) 💖. Those bindings are used to pick the right encapsulation destination address for inbound IPv4 packets, and also to validate the IPv6-IPv4 source of outbound IPv4-in-IPv6 packets ✨.
The BR gets its binding info through the IPv4 address provisioning process. For static configuration, the operator manually configures the BR using the binding information agreed on with the customer. For DHCPv4 over IPv6, there are multiple possibilities, and they depend on the deployment 🦋:
- The BR can be co-located with the DHCPv4-over-IPv6 server. Then the synchronization happens within the BR. It installs a binding when sending out an ACK for a DHCP lease, and deletes it when the lease expires or a DHCP RELEASE message is received.
- The BR can play the role of IPv6-Transport Relay Agent (TRA) as described in [DHCPv4-IPv6], snoop for the DHCPv4 ACK and RELEASE messages, and keep a timer for each binding according to the DHCP lease time.
On the IPv6 side, the BR decapsulates IPv4-in-IPv6 packets coming from 4over6 CEs 🍓. It removes the IPv6 header from every IPv4-in-IPv6 packet and forwards it to the IPv4 Internet. Before decapsulating, the BR checks the inner IPv4 source address against the outer IPv6 source address by matching them to a binding entry in the binding table. If no binding is found, the BR silently drops the packet 💀.
On the IPv4 side, the BR encapsulates the IPv4 packets destined for 4over6 CEs 🌸. When it does the IPv4-in-IPv6 encapsulation, the BR uses its own IPv6 address as the IPv6 source address, and it uses the IPv4 destination address in the packet to look up the IPv6 destination address in the address-binding table. After encapsulating, the BR sends the IPv6 packet out its IPv6 interface to reach a CE 🧚.
The BR supports hairpinning of traffic between two CEs by decapsulating and re-encapsulating the packets 🫶.
If the BR manages the global IPv4 address pool, it advertises the routing information of those IPv4 addresses to the IPv4 Internet 🌈.
7. Fragmentation and Reassembly 💅
The same considerations described in Sections 5.3 and 6.3 of [RFC6333] apply to the CE and the BR, respectively 🎀.
8. DNS 🦋
The procedure described in Sections 5.5 and 6.4 of [RFC6333] is followed by the CE and the BR, respectively 💜.
9. Security Considerations 🔒
okay so the 4over6 BR has methods to limit service to registered customers only 🫶 on the control plane, the BR only hands out IPv4 addresses to registered customers. it can filter on the IPv6 source addresses of incoming DHCP requests and only respond to the ones coming from registered IPv6 source addresses. BUT ngl this doesn't work when multi-homing is present 💀 so in networks where Public 4over6 is deployed, multi-homing is disallowed to avoid this issue. no multi-homing, no problem 🙅♀️
alternatively, the BR can filter out the unregistered CE's requests during the DHCP process 🎀 and for data packets, the BR does ingress filtering by looking up addresses in the IPv4-IPv6 address-binding table for the related matches, as described in Section 6. lowkey the binding table is doing the heavy lifting here 👑
In the case of fallback to DS-Lite, security considerations in Section 11 of [RFC6333] are followed. 🚨 if you ever fall back to DS-Lite, go read Section 11 of [RFC6333] and follow it. no skipping!!
10. Contributors 🌸
the following are the amazing people who made contributions to this effort 🫶✨
Huiling Zhao
China Telecom
Room 502, No.118, Xizhimennei Street
Beijing 100035
P.R.China
Phone: +86-10-58552002
Email: zhaohl@ctbri.com.cn
Chongfeng Xie
China Telecom
Room 708, No.118, Xizhimennei Street
Beijing 100035
P.R.China
Phone: +86-10-58552116
Email: xiechf@ctbri.com.cn
Qiong Sun
China Telecom
Room 708, No.118, Xizhimennei Street
Beijing 100035
P.R.China
Phone: +86-10-58552936
Email: sunqiong@ctbri.com.cn
Qi Sun
Tsinghua University
Beijing 100084
P.R.China
Phone: +86-10-62785822
Email: sunqi@csnet1.cs.tsinghua.edu.cn
Chris Metz
Cisco Systems
3700 Cisco Way
San Jose, CA 95134
USA
Email: chmetz@cisco.com11. References 📚
11.1. Normative References 💜
[RFC2473] Conta, A. and S. Deering, "Generic Packet Tunneling in
IPv6 Specification", RFC 2473, December 1998.
[RFC4925] Li, X., Dawkins, S., Ward, D., and A. Durand, "Softwire
Problem Statement", RFC 4925, July 2007.
[RFC6333] Durand, A., Droms, R., Woodyatt, J., and Y. Lee, "Dual-
Stack Lite Broadband Deployments Following IPv4
Exhaustion", RFC 6333, August 2011.
[RFC6334] Hankins, D. and T. Mrugalski, "Dynamic Host Configuration
Protocol for IPv6 (DHCPv6) Option for Dual-Stack Lite",
RFC 6334, August 2011.11.2. Informative References 🦋
[DHCPv4-IPv6]
Cui, Y., Wu, P., Wu, J., Lemon, T., and Q. Sun, "DHCPv4
over IPv6 Transport", Work in Progress, October 2013.
[SOFTWIRE-CPE]
Boucadair, M., Farrer, I., Perreault, S., Ed., and S.
Sivakumar, Ed., "Unified IPv4-in-IPv6 Softwire CPE", Work
in Progress, May 2013.
[SOFTWIRE-LW46]
Cui, Y., Sun, Q., Boucadair, M., Tsou, T., Lee, Y., and I.
Farrer, "Lightweight 4over6: An Extension to the DS-Lite
Architecture", Work in Progress, November 2013.Authors' Addresses 🎀
Yong Cui
Tsinghua University
Beijing 100084
P.R.China
Phone: +86-10-6260-3059
EMail: yong@csnet1.cs.tsinghua.edu.cn
Jianping Wu
Tsinghua University
Beijing 100084
P.R.China
Phone: +86-10-6278-5983
EMail: jianping@cernet.edu.cn
Peng Wu
Tsinghua University
Beijing 100084
P.R.China
Phone: +86-10-6278-5822
EMail: pengwu.thu@gmail.com
Olivier Vautrin
Juniper Networks
1194 N. Mathilda Avenue
Sunnyvale, CA 94089
USA
EMail: Olivier@juniper.net
Yiu L. Lee
Comcast
One Comcast Center
Philadelphia, PA 19103
USA
EMail: yiu_lee@cable.comcast.comthat's the whole RFC, bestie 🌈💖 the authors really brought the receipts 💅
📦 where this page comes from
- ietf: rfc7040 2013-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms