RFC 7404

Using Only Link-Local Addressing inside an IPv6 Network

📅 published November 2014, from ietf

RFC 7404 🦋 Using Only Link-Local Addressing inside an IPv6 Network

Okay bestie, so this is RFC 7404 💖 with the title Using Only Link-Local Addressing inside an IPv6 Network. It came out in November 2014 from the IETF. The authors are M. Behringer and E. Vyncke, both at Cisco. It's marked Informational (so no Standards Track vibes, just helpful info) and its ISSN is 2070-1721 ✨. It doesn't list any RFCs it obsoletes or updates, so it's a standalone doc 🌸

Abstract

Ok so the big idea is that in an IPv6 network you can use only link-local addresses on the infrastructure links between routers 🧚 The doc talks through the advantages and the disadvantages of doing that, so you can decide whether it's the move for your network 💅

Status of This Memo

This doc is not an Internet Standards Track spec. It's just published for info purposes 🌈

It's a product of the IETF and it reflects what the IETF community agrees on. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every IESG-approved doc is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 if you want the details 🎀

For the current status, any errata, or to send feedback, go to http://www.rfc-editor.org/info/rfc7404 🔗

Copyright Notice

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at http://trustee.ietf.org/license-info. Those rules are the ones in effect on the publication date, so please read them carefully because they spell out your rights and restrictions for this doc 📜

If you pull Code Components out of this doc, they have to include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They also come without warranty, as described in the Simplified BSD License 🫶

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
2.  Using Link-Local Addressing on Infrastructure Links . . . . .   2
  2.1.  The Approach  . . . . . . . . . . . . . . . . . . . . . .   3
  2.2.  Advantages  . . . . . . . . . . . . . . . . . . . . . . .   4
  2.3.  Caveats . . . . . . . . . . . . . . . . . . . . . . . . .   5
  2.4.  Internet Exchange Points  . . . . . . . . . . . . . . . .   6
  2.5.  Summary . . . . . . . . . . . . . . . . . . . . . . . . .   7
3.  Security Considerations . . . . . . . . . . . . . . . . . . .   8
4.  Informative References  . . . . . . . . . . . . . . . . . . .   8
Acknowledgments   . . . . . . . . . . . . . . . . . . . . . . . .  10
Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  10

1. Introduction 🌸

An infrastructure link between a bunch of routers usually doesn't need global or unique local addresses [RFC4193]. Using only link-local addressing on those links comes with a lot of perks. For example, routing tables don't have to carry link addressing, so they can end up way smaller 🍓 That helps failover times get quicker during certain routing convergence events. Also, a router's interface isn't reachable beyond the link boundaries, which cuts down the attack surface 🛡️

This doc is all about the advantages and caveats of this approach 💅

Heads up, though: some of the classic tricks you use to run a network don't work with this setup. Pinging interfaces and seeing interface info in a traceroute are the big ones. We get into the details below 👀

During WG and IETF last call, people checked that the doc was technically correct. There's still debate about whether to actually recommend this technique 🤔 So the deal is: use it where it's found to be necessary, and that's it ✨

2. Using Link-Local Addressing on Infrastructure Links 🦋

This doc looks at using only link-local addresses (LLAs) on every router interface on infrastructure links 💖 Routers don't usually need to get packets from hosts or nodes outside the network. But a network operator might have reasons to use addresses with a bigger scope than link-local on infrastructure interfaces, for operational stuff like pinging an interface or running traceroutes across the network 🧚 This doc covers those cases and suggests alternative procedures for them 💜

2.1. The Approach 💅

So here's the idea: no globally routed IPv6 addresses and no unique local addresses on infrastructure links 🌈 If there aren't any global or unique local addresses defined, routers just default to link-local addresses, especially for routing protocols 🫶

Sending ICMPv6 [RFC4443] error messages like "packet-too-big" and "time-exceeded" is required for routers. So another interface has to be set up with an IPv6 address that has a bigger scope than link-local 🎀 Usually that's a loopback interface with a global scope address that belongs to the operator. It's also part of an announced prefix (with a suitable prefix length), so other routers that do ingress filtering [RFC3704] don't drop it 🔥 How you do this depends on the implementation. For the rest of this doc, we'll call that interface a "loopback interface" 🌸

[RFC6724] recommends that IPv6 addresses with a bigger scope than link-local be used as the source address for all generated ICMPv6 messages sent to a non-link-local address. The one exception is ICMPv6 redirect messages, which are defined in Section 4.5 of [RFC4861] 🍓

Here's how this approach plays out for different traffic types:

Control plane protocols: Most of them, like BGP [RFC4271], IS-IS [IS-IS], OSPFv3 [RFC5340], Routing Information Protocol Next Generation (RIPng) [RFC2080], and PIM [RFC4609], work by default or can be configured to work with link-local addresses. The exceptions are explained in the caveats section (Section 2.3) ⭐
Management plane traffic: Things like Secure SHell (SSH) Protocol [RFC4251], Telnet [RFC0495], Simple Network Management Protocol (SNMP) [RFC1157], and ICMPv6 Echo Request [RFC4443] can use the address of the router's loopback interface as the destination address. Router management can also happen over out-of-band channels 💖
ICMP error messages: These are usually sourced from a loopback interface with a scope bigger than link-local. Section 4.5 of [RFC4861] points out one exception: ICMP redirect messages can also come from a link-local address 🙈
Data plane traffic: This gets forwarded no matter what kind of link address is used 🚀
Neighbor discovery: Neighbor solicitation and neighbor advertisement use link-local unicast and multicast addresses. So neighbor discovery isn't affected at all 🫶

So yeah, it's totally possible to build a working network this way 🎉

2.2. Advantages 🌈

This list of advantages isn't in any particular order, so don't read anything into the layout 💅

Smaller routing tables: The routing protocol only has to carry one global address per router (the loopback interface). That's way smaller than the traditional approach, where every infrastructure link address gets carried in the routing protocol 🍓 This cuts memory use and speeds up convergence in some routing failover cases. The Forwarding Information Base that gets downloaded to line cards is also smaller, and there are fewer prefixes in the Routing Information Base, so the routing algorithm gets a boost 🔥 Also worth knowing: you can get smaller routing tables by putting interfaces in passive mode for the Interior Gateway Protocol (IGP) ✨
Simpler address management: You only have to think about loopback interface addresses in your addressing plan. That also makes renumbering easier 🧚
Lower configuration complexity: Link-local addresses don't need any specific configuration, which keeps router configs smaller and less complicated. It also means fewer chances for config mistakes 🎀
Simpler DNS: Less routable address space in use means fewer reverse and forward mapping DNS resource records to maintain. Of course, if the operator decides not to put any global interface addresses in the DNS anyway, then this one isn't as big of a win 💀
Reduced attack surface: Every routable address on a router is a possible attack point. A remote attacker can send traffic to that address, like a TCP SYN flood (see [RFC4987]) 😭 If a network only uses the addresses of the router loopback interface(s), then only those addresses need protection from outside the network. That can make protection measures easier, like Infrastructure Access Control Lists (iACL) 🛡️ Even without link-local addresses, you can still get a simple iACL if your addressing scheme gives all link and loopback interfaces addresses bigger than link-local that are aggregatable, and if the infrastructure access list covers that whole aggregated space 💜 See also [RFC6752] for more on this topic. [RFC6860] describes another way to hide addressing on infrastructure links for OSPFv2 and OSPFv3, by modifying the existing protocols. This doc doesn't modify any protocol, and it only applies to IPv6 🌸

2.3. Caveats 💅

okay so the caveats in this section are NOT in any particular order, so don't read anything into the vibe of the list 🙈

Interface ping 🏓: if an interface doesn't have a routable address, it can only be pinged from a node on the same link. so it's not possible to ping a specific link interface remotely 😭 a possible workaround is to ping the loopback address of a router instead. in most cases today you can't see which link the packet came in on, BUT [RFC5837] suggests putting the interface identifier of the interface a packet was received on into the ICMPv6 response. ngl there are few implementations of this ICMPv6 extension, so it's not super common yet. with this approach you could ping a router on the addresses of its loopback interfaces and still see which interface the packet was received on. to check liveliness of a specific interface, you may need other methods, like connecting to the router via SSH and checking locally, or using SNMP 🧚

Traceroute 🗺️: this is kind of the same story as ping. a reply to a traceroute packet would come from the address of a loopback interface, and current implementations don't show the specific interface the packets came in on. again, [RFC5837] has a solution. and just like with ping, you can't traceroute to a particular interface if it only has a link-local address 💀 BUT here's the iconic part: this approach may make network topology discovery from outside the network simpler. instead of responding with multiple different interface IP addresses (which the outsider has to correlate, ugh), a router will always respond with the same loopback address. the way that's giving clean 🫶 if reverse DNS mapping is used, the mapping is trivial either way.

Hardware dependency 🔧: LLAs have usually been based on 64-bit Extended Unique Identifiers (EUI-64), so they change when the Message Authentication Code (MAC) address changes. this could be a problem when the routing neighbor has to be configured explicitly (for example, BGP) and a line card needs to be physically replaced. that changes the EUI-64 LLA and breaks the routing neighborship, which is a whole vibe nobody wants 😭 the fix is that LLAs can be statically configured, like fe80::1 and fe80::2, and those can be used to configure any required static routing neighborship. however, this static LLA configuration may be more complex to operate than statically configured addresses that are greater than link-local scope. that's because LLAs are inherently ambiguous 🌀 for a multi-link node, such as a router, to deal with the ambiguity, the link zone index must also be considered explicitly. you can do that with the extended textual notation described in [RFC4007], like in this example: BGP neighbor fe80::1%eth0 is down ✨

Network Management System (NMS) toolkits 🛠️: if there's any NMS tool that uses an interface IP address of a router to carry out its NMS functions, it will stop working if that interface doesn't have a routable address 💔 a possible workaround for those tools is to use the routable address of the router's loopback interface instead. most vendor implementations let you specify loopback interface addresses for SYSLOG, IPFIX, and SNMP. the Link Layer Discovery Protocol (LLDP) (IEEE 802.1AB-2009) runs directly over Ethernet and doesn't need any IPv6 address, so dynamic network discovery isn't hindered by using only LLA when you're using LLDP 🎀 but network discovery based on Neighbor Discovery Protocol (NDP) cache content will only show the link-local addresses, not the addresses of the loopback interfaces. so network discovery should be based on the Route Information Base to detect adjacent nodes instead.

MPLS and RSVP-Traffic Engineering (RSVP-TE) 🌈 [RFC3209] lets you establish an MPLS Label Switched Path (LSP) on a path that's explicitly identified by a strict sequence of IP prefixes or addresses (each one pertaining to an interface or a router on the path). this is commonly used for Fast Reroute (FRR). however, if an interface only uses a link-local address, those LSPs cannot be established 😩 at the time of writing this document, there's no workaround for this case. so where RSVP-TE is being used, the approach described in this document does not work 🥲

2.4. Internet Exchange Points 🌸

Internet Exchange Points (IXPs) are super important in the global Internet, because they connect a high number of networks in a single location and a significant part of Internet traffic passes through at least one IXP 👑 so an IXP needs a very high level of security. the address space used on an IXP is generally known, since it's registered in the global Internet Route Registry, or it's easily discoverable through traceroute. the IXP prefix is especially critical, because practically all addresses on this prefix are critical systems in the Internet 😳

apart from general device security guidelines, there are basically two additional ways to raise security (see also [BGP-OPSEC]):

Not to announce the prefix in question, and
To drop all traffic from remote locations destined to the IXP prefixes.

not announcing the IXP prefix would frequently result in traceroute and similar packets (required for Path MTU Discovery (PMTUD)) being dropped because of unicast Reverse Path Forwarding (uRPF) checks 🙅‍♀️ and since PMTUD is critical, this is generally not acceptable. dropping all external traffic to the IXP prefix is hard to implement, because if just one service provider connected to an IXP doesn't filter correctly, then all IXP routers are reachable from at least that service provider's network 💀

as the prefix used in the IXP is usually longer than a /48, it's frequently dropped by route filters on the Internet, which has the same net effect as not announcing the prefix 🙃

using link-local addresses on the IXP may help in this scenario 🦋 in this case, the generated ICMPv6 packets would come from loopback interfaces, or from any other interface with a globally routable address, without any configuration. however, each service provider would use their own address space in this case, which makes a generic attack against all devices on the IXP harder. ngl, all of an IXP's loopback interface addresses can still be discovered by a potential attacker with a simple traceroute. so a generic attack is still possible, it just takes more work 😤

in some cases, service providers carry the IXP addresses in their IGP for certain forms of traffic engineering across multiple exit points. link-local addresses can't be used for this purpose, so the service provider would have to use other methods of traffic engineering 🧩

if an Internet Exchange Point uses a global prefix registered for this purpose, a traceroute will indicate whether the trace crosses an IXP rather than a private interconnect ✨ if link-local addressing is used instead, a traceroute won't provide this distinction.

2.5. Summary 📝

exclusively using link-local addressing on infrastructure links has a number of advantages and disadvantages, and both are described in detail in this document. a network operator can use this document to evaluate whether or not using link-local addressing on infrastructure links is a good idea for their network. this document makes no particular recommendation either in favor of or against it 🫶

3. Security Considerations 🔐

using only LLAs on infrastructure links reduces the attack surface of a router 🛡️ loopback interfaces with routed addresses are still reachable and must be secured, but infrastructure links can only be attacked from the local link. this simplifies the security of control and management planes 👑 the approach does not impact the security of the data plane. the link-local-only approach does not address control plane [RFC6192] attacks generated by data plane packets (such as hop-limit expiration or packets containing a hop-by-hop extension header) 😭

for additional security considerations, as previously stated, see also [RFC5837] and [BGP-OPSEC] 🔥

4. Informative References ✨

okay bestie, here's the reading list 📚 these are the informative refs, meaning the other docs this one points to for background. none of them are required reading to get the main idea, but they're the good stuff if you wanna go deeper 🧚

[BGP-OPSEC]
           Durand, J., Pepelnjak, I., and G. Doering, "BGP operations
           and security", Work in Progress, draft-ietf-opsec-bgp-
           security-05, August 2014.

[IS-IS]    International Organization for Standardization,
           "Intermediate System to Intermediate System intra-domain
           routeing information exchange protocol for use in
           conjunction with the protocol for providing the
           connectionless-mode network service (ISO 8473)", ISO
           Standard 10589, 2002.

[RFC0495]  McKenzie, A., "Telnet Protocol specifications", RFC 495,
           May 1973, <http://www.rfc-editor.org/info/rfc0495>.

[RFC1157]  Case, J., Fedor, M., Schoffstall, M., and J. Davin,
           "Simple Network Management Protocol (SNMP)", STD 15, RFC
           1157, May 1990, <http://www.rfc-editor.org/info/rfc1157>.

[RFC2080]  Malkin, G. and R. Minnear, "RIPng for IPv6", RFC 2080,
           January 1997, <http://www.rfc-editor.org/info/rfc2080>.

[RFC3209]  Awduche, D., Berger, L., Gan, D., Li, T., Srinivasan, V.,
           and G. Swallow, "RSVP-TE: Extensions to RSVP for LSP
           Tunnels", RFC 3209, December 2001,
           <http://www.rfc-editor.org/info/rfc3209>.

[RFC3704]  Baker, F. and P. Savola, "Ingress Filtering for Multihomed
           Networks", BCP 84, RFC 3704, March 2004,
           <http://www.rfc-editor.org/info/rfc3704>.

[RFC4007]  Deering, S., Haberman, B., Jinmei, T., Nordmark, E., and
           B. Zill, "IPv6 Scoped Address Architecture", RFC 4007,
           March 2005, <http://www.rfc-editor.org/info/rfc4007>.

[RFC4193]  Hinden, R. and B. Haberman, "Unique Local IPv6 Unicast
           Addresses", RFC 4193, October 2005,
           <http://www.rfc-editor.org/info/rfc4193>.

[RFC4251]  Ylonen, T. and C. Lonvick, "The Secure Shell (SSH)
           Protocol Architecture", RFC 4251, January 2006,
           <http://www.rfc-editor.org/info/rfc4251>.

[RFC4271]  Rekhter, Y., Li, T., and S. Hares, "A Border Gateway
           Protocol 4 (BGP-4)", RFC 4271, January 2006,
           <http://www.rfc-editor.org/info/rfc4271>.

[RFC4443]  Conta, A., Deering, S., and M. Gupta, "Internet Control
           Message Protocol (ICMPv6) for the Internet Protocol
           Version 6 (IPv6) Specification", RFC 4443, March 2006,
           <http://www.rfc-editor.org/info/rfc4443>.

[RFC4609]  Savola, P., Lehtonen, R., and D. Meyer, "Protocol
           Independent Multicast - Sparse Mode (PIM-SM) Multicast
           Routing Security Issues and Enhancements", RFC 4609,
           October 2006, <http://www.rfc-editor.org/info/rfc4609>.

[RFC4861]  Narten, T., Nordmark, E., Simpson, W., and H. Soliman,
           "Neighbor Discovery for IP version 6 (IPv6)", RFC 4861,
           September 2007, <http://rfc-editor.org/info/rfc4861>.

[RFC4987]  Eddy, W., "TCP SYN Flooding Attacks and Common
           Mitigations", RFC 4987, August 2007,
           <http://www.rfc-editor.org/info/rfc4987>.

[RFC5340]  Coltun, R., Ferguson, D., Moy, J., and A. Lindem, "OSPF
           for IPv6", RFC 5340, July 2008,
           <http://www.rfc-editor.org/info/rfc5340>.

[RFC5837]  Atlas, A., Bonica, R., Pignataro, C., Shen, N., and JR.
           Rivers, "Extending ICMP for Interface and Next-Hop
           Identification", RFC 5837, April 2010,
           <http://www.rfc-editor.org/info/rfc5837>.

[RFC6192]  Dugal, D., Pignataro, C., and R. Dunn, "Protecting the
           Router Control Plane", RFC 6192, March 2011,
           <http://www.rfc-editor.org/info/rfc6192>.

[RFC6724]  Thaler, D., Draves, R., Matsumoto, A., and T. Chown,
           "Default Address Selection for Internet Protocol Version 6
           (IPv6)", RFC 6724, September 2012,
           <http://www.rfc-editor.org/info/rfc6724>.

[RFC6752]  Kirkham, A., "Issues with Private IP Addressing in the
           Internet", RFC 6752, September 2012,
           <http://www.rfc-editor.org/info/rfc6752>.

[RFC6860]  Yang, Y., Retana, A., and A. Roy, "Hiding Transit-Only
           Networks in OSPF", RFC 6860, January 2013,
           <http://www.rfc-editor.org/info/rfc6860>.

Acknowledgments 🫶

okay the authors wanna give a huge thank-you to Salman Asadullah, Brian Carpenter, Bill Cerveny, Benoit Claise, Rama Darbha, Simon Eng, Wes George, Fernando Gont, Jen Linkova, Harald Michl, Janos Mohacsi, Ivan Pepelnjak, Alvaro Retana, Jinmei Tatuya, and Peter Yee for their useful comments about this work 💖 literally the best crew ever 🙌

Authors' Addresses 🦋

Who wrote this bad boy 👑

Michael Behringer
Cisco
Building D, 45 Allee des Ormes
Mougins  06250
France

EMail: mbehring@cisco.com


Eric Vyncke
Cisco
De Kleetlaan, 6A
Diegem  1831
Belgium

EMail: evyncke@cisco.com

📦 where this page comes from

ietf: rfc7404 2014-11
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms