RFC 7563

Extensions to the Proxy Mobile IPv6 (PMIPv6) Access Network Identifier Option

📅 published June 2015, from ietf

RFC 7563: Extensions to the Proxy Mobile IPv6 (PMIPv6) Access Network Identifier Option ✨

okay bestie, this is the spec that gives the ANI option some main character energy 🎀 Here's the lowdown:

  • RFC number: 7563
  • Updates: RFC 6757 🔄
  • Category: Standards Track
  • ISSN: 2070-1721
  • Date: June 2015 📅
  • Authors: R. Pazhyannur (Cisco Systems), S. Speicher (Cisco Systems), S. Gundavelli (Cisco Systems), J. Korhonen (Broadcom Corporation), and J. Kaippallimalil (Huawei) 💜

Abstract 🌸

So the Access Network Identifier (ANI) mobility option came out in RFC 6757, "Access Network Identifier (ANI) Option for Proxy Mobile IPv6". It lets a Mobile Access Gateway (MAG) share stuff like the network identifier, geolocation, and operator identifier. This spec levels it up with sub-options for the civic location and the MAG group identifier 🧚. It also adds an ANI Update-Timer sub-option that decides when and how often the ANI option gets refreshed ⭐.

Status of This Memo 📋

This is an Internet Standards Track document.

It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741.

For the current status, any errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc7563 🔍

Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, because they spell out your rights and restrictions for this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License 📜

Table of Contents 📚

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
2.  Conventions and Terminology . . . . . . . . . . . . . . . . .   4
  2.1.  Conventions . . . . . . . . . . . . . . . . . . . . . . .   4
  2.2.  Terminology . . . . . . . . . . . . . . . . . . . . . . .   4
3.  Protocol Extension  . . . . . . . . . . . . . . . . . . . . .   5
  3.1.  Civic-Location Sub-Option . . . . . . . . . . . . . . . .   5
  3.2.  MAG-Group-Identifier Sub-Option . . . . . . . . . . . . .   6
  3.3.  ANI Update-Timer Sub-Option . . . . . . . . . . . . . . .   6
4.  Protocol Considerations . . . . . . . . . . . . . . . . . . .   7
  4.1.  MAG Considerations  . . . . . . . . . . . . . . . . . . .   7
  4.2.  LMA Considerations  . . . . . . . . . . . . . . . . . . .   8
5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   9
6.  Security Considerations . . . . . . . . . . . . . . . . . . .  10
7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  11
  7.1.  Normative References  . . . . . . . . . . . . . . . . . .  11
  7.2.  Informative References  . . . . . . . . . . . . . . . . .  11
Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .  12
Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  12

1. Introduction 🌈

"Access Network Identifier (ANI) Option for Proxy Mobile IPv6" [RFC6757] introduced the ANI mobility option. It let a Mobile Access Gateway (MAG) provide the Network-Identifier, Geo-Location, and Operator-Identifier sub-options 💅. When the access network is WLAN, the Network-Identifier sub-option can hold the Service Set Identifier (SSID) and the Basic Service Set Identifier (BSSID) of the Access Point (AP) plus the AP's geolocation, and the Operator-Identifier can hold the realm of the operator running the WLAN 📶. The MAG sends all of that to the Local Mobility Anchor (LMA). The LMA may use it to work out access-network-specific policies (like Quality of Service (QoS), Deep Packet Inspection (DPI), and so on) 🔥. The LMA may also share this info with location-based applications.

So those sub-options are already a lot, but this document is about extending the ANI sub-options, especially for WLAN deployments 🦋. In WLAN setups (especially indoor AP setups), it's hard to get geospatial coordinates for APs 🙈. Meanwhile, plenty of location-based apps are happy with a civic location. That's the reason for the ANI Civic-Location sub-option 💖. Lots of operators also group their APs into "AP-Groups", and each group has a group identifier. That identifier works as a stand-in for coarse location, like the floor of a building or a small building 🏢. It can also set a shared policy (for example QoS, charging, or DPI) for every AP in the group. This spec gives the MAG a sub-option to send a group identifier to the LMA. How the group identifier gets provisioned is outside the scope of this spec. It's usually done through a configuration mechanism like the CLI (Command-line Interface) or through Control and Provisioning of Wireless Access Points (CAPWAP) [RFC5415] [RFC5416] 🛠️

This document also adds a new sub-option that controls how often the MAG updates the ANI ⏰. In typical deployments, the MAG is expected to update the ANI as soon as it changes, and that's definitely true when the MAG is co-located with the AP ✨. When a client roams from one AP to another, the MAG on the roamed-to AP (sometimes called the target AP) provides the new ANI, like the network identifier and geolocation of the new AP 🏃‍♀️. But if the MAG is co-located with an Access Controller (also called a Wireless LAN Controller (WLC)), then a client roaming between APs doesn't necessarily trigger an ANI update 😭. The WLC handles client mobility between APs, so intra-WLC mobility stays hidden from the LMA 🫣.

In those deployments, the info in the ANI sub-options (like location) gets stale and only refreshes when the lifetime expires 🥀. The MAG could fix that by sending a Proxy Binding Update (PBU) every time a client moves between APs, just to update the ANI sub-option 📨. Or, this document lets the LMA decide how often it wants to hear about changes in the ANI sub-option 🧠. Sometimes the LMA only cares about the ANI at initial binding, and sometimes it cares about every single AP transition 👀. The sub-option lets the LMA tell the MAG the update frequency it wants. As always, mobility events or re-registration events also update the ANI sub-options 🔄. The LMA can use the ANI Update-Timer option to set the maximum frequency at which it wants ANI updates. This is especially useful when one MAG covers tons of Wi-Fi APs and clients are zooming between them 🏟️. Say it's a stadium Wi-Fi deployment, and the LMA doesn't want ANI updates any more often than every 100 seconds. Then it can propose 100 seconds as the ANI Update-Timer value 🎯

[RFC6757] already has ANI sub-options for geolocation info. This document adds sub-options for the civic location and the group identifier. It also defines an ANI sub-option that lets a MAG say how often it'll update the ANI information 💜

2. Conventions and Terminology 📖

2.1. Conventions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. Those words are the official rules-words, so they keep their exact strength here 🔐.

2.2. Terminology

All the mobility-related terms in this document are to be interpreted as defined in [RFC5213] and [RFC5844] 🧩. Here, Civic Location is defined as follows:

Civic Location: There are two common ways to identify the location of an object: geospatial coordinates or so-called civic addresses. Geospatial coordinates indicate longitude, latitude, and altitude, while civic addresses indicate a street address or sometimes the location within a building (such as a room number). Civic location refers to the civic address. 🏠

3. Protocol Extension 🎀

3.1. Civic-Location Sub-Option

The Civic-Location is a mobility sub-option carried in the Access Network Identifier option defined in [RFC6757]. This sub-option carries the civic location info of the mobile node as the MAG knows it. The format is defined below 🗺️

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|ANI Type=4     |  ANI Length   |   Format      | Reserved      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|            civic location                                     ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Figure 1: Civic-Location Sub-Option 🖼️

ANI Type: 4

ANI Length: The total length of this sub-option in octets, not counting the ANI Type and ANI Length fields 📏

Format: This specifies the encoding format of the civic location. The value 0 is defined in this specification, as described below. The remaining values (1 through 255) are reserved 🔢

  • 0: This value denotes Binary Encoding. The location format is based on the encoding format defined in Section 3.1 of [RFC4776], where the first 3 octets are not put into the civic location field. That means the code for the DHCP option, the length of the DHCP option, and the 'what' element are left out. What's included is the two-octet country code field, followed by one or more civic address elements. The country-code is a two-letter ISO 3166 country code in capital ASCII letters, e.g., US. The structure of the civic address elements that follow the country code field is as defined in Section 3.3 of [RFC4776] 🌍

Reserved: This MUST be set to zero when sending and ignored when received 🫧

civic location: This field contains the civic location. The format (encoding) type is specified in the Format field of this sub-option. Note that the length SHALL NOT exceed 253 bytes 🚫

3.2. MAG-Group-Identifier Sub-Option 🫶

okay so the MAG group identifier is a mobility sub-option that rides inside the Access Network Identifier option from [RFC6757] 🎀. It tells you which group the MAG belongs to inside that Proxy Mobile IPv6 domain. bestie, it is NOT guaranteed to be globally unique across different network operators 🙈. within one operator network, it should be unique, though. and if your domain spans multiple operators, it's recommended to also use the Operator-Identifier sub-option (from [RFC6757]) alongside this one so you get uniqueness 💅. when the MAG has a group identifier configured, it should send that identifier in the PBU ✨. configuring the identifier is out of scope for this spec, and how the LMA uses it is up to the implementation 🧚. the format is below 👇

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |ANI Type=5     |  ANI Length   |  group identifier             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Figure 2: MAG-Group-Identifier Sub-Option

  • ANI Type: 5
  • ANI Length: the total length of this sub-option in octets, not counting the ANI Type and ANI Length fields. it's always 2 💖
  • group identifier: a 3-octet unsigned integer assigned to a group of MAGs 🌸

3.3. ANI Update-Timer Sub-Option ⏰

the ANI Update-Timer is a mobility sub-option that lives in the ANI option from [RFC6757] ✨. Section 4 explains how the MAG and LMA use it, so go check that out 👀.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |ANI Type=6     |  ANI Length   |       Update-Timer            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Figure 3: ANI Update-Timer Sub-Option

  • ANI Type: 6
  • ANI Length: the total length of this sub-option in octets, not counting the ANI Type and ANI Length fields. always 2 🎀
  • Update-Timer: a 16-bit unsigned integer 🔥. the unit is 4 seconds, which keeps it consistent with the time units used for the binding lifetime ⭐. a value of 0 means the MAG sends an updated ANI mobility option as soon as it notices a change in ANI values. any non-zero value means the MAG may not send ANI values right away after they change, and instead sends ANI updates when the Update-Timer expires 🦋

4. Protocol Considerations 🌈

okay the following considerations apply to both the LMA and the MAG, so read up 📖.

4.1. MAG Considerations 📡

  • the conceptual Binding Update List entry data structure kept by the mobile access gateway (described in Section 6.1 of [RFC5213]) gets extended to store the access-network-related information elements tied to the current session 💅. specifically, these parameters are defined:
    • civic location
    • MAG group identifier
    • ANI Update-Timer
  • if the mobile access gateway is configured to support the Access Network Information sub-options from this spec, it includes this option with those specific sub-options in all PBU messages it sends to the LMA. that includes PBUs for lifetime extension and for deregistration too 🫶. the Access Network Information option is built the way Section 3 says ✨
  • ANI Update-Timer considerations: the MAG sets the Update-Timer based on an exchange of timer values with the LMA ⏱️. when the ANI Update-Timer sub-option is carried in a PBU, it counts as a proposed value for the Update-Timer. the LMA may change the value it received in the PBU. when the LMA-provided value differs from what the MAG sent, the MAG should use the LMA-provided value 💖. if the MAG doesn't get an ANI Update-Timer sub-option back in the Proxy Binding Acknowledgement (PBA) (in response to sending it in the PBU), then the MAG behaves according to [RFC6757] 🙈.
    • when ANI parameters of a mobility session change, the MAG checks whether the Update-Timer has expired. if it has, the MAG sends a PBU with the ANI option, and that option reflects the updated access network parameters for that session 🔥. if it hasn't expired, the MAG does not send a PBU 💅.
    • when the Update-Timer for a mobility session expires, the MAG checks whether the ANI parameters have changed. if they changed from the last reported values, the MAG sends a PBU with an ANI option. if they didn't change, the MAG does not send a PBU, and the Update-Timer just stays expired 🌸.
    • the MAG may send a PBU even before the Update-Timer expires 🦋. for example, it might do that to start a QoS service request to the LMA (see [RFC7222]) ✨. in those cases, the MAG must reset the Update-Timer when it sends a PBU 👑.
  • if the mobile access gateway had any of the Access Network Information mobility options in a PBU sent to an LMA, then the PBA it gets back from the LMA should contain the Access Network Information mobility option with those specific sub-options 🎀. if the MAG receives a PBA with a successful Status Value but without an Access Network Information mobility option, then the MAG may log the event and, based on its local policy, even go ahead and terminate the mobility session 💀. in that situation, the MAG knows the LMA doesn't understand the Access Network Information mobility option 🧚

4.2. LMA Considerations 🏠

  • the conceptual Binding Cache entry data structure kept by the LMA (described in Section 5.1 of [RFC5213]) gets extended to store the access-network-related information elements tied to the current session ✨. specifically, these parameters are defined:
    • civic location
    • MAG group identifier
    • ANI Update-Timer
  • on receiving a PBU message from a MAG with the ANI option, the LMA must process the option and update the matching fields in the Binding Cache entry 💅. if that LMA implementation doesn't understand the option, it skips the option and processes the PBU without it 🙈.
  • if the received PBU message does not include the Access Network Information option, then the mobility session linked to that PBU gets updated to remove any access network information elements 🫧.
  • if the LMA understands or supports the Access Network Identifier mobility sub-options defined in this spec, then the LMA echoes the Access Network Identifier mobility option, with whichever specific sub-options it accepted, back to the mobile access gateway in a PBA 🦋. the Civic-Location and MAG-Group-Identifier sub-options defined in this spec should not be altered by the LMA 🔒. the LMA may change the value of the ANI Update-Timer sub-option. it can echo the same value, or increase or decrease it ⏰. for example, if the LMA doesn't want frequent updates (as the timer value implies), it may increase the value 🌙. similarly, if the LMA needs ANI updates as soon as possible, it may set the value to zero (0) in the PBA 🔥.

5. IANA Considerations 📋

IANA has registered the values described below 🎀.

  • this specification defines a new Access Network Identifier sub-option called the Civic-Location sub-option 📍. it's described in Section 3.1, and it can be carried in the Access Network Identifier mobility option. the type value <4> has been allocated from the registry "Access Network Information (ANI) Sub-Option Type Values" 💖.
  • this specification defines a new Access Network Identifier sub-option called the MAG-Group-Identifier sub-option 🌈. it's described in Section 3.2, and it can be carried in the Access Network Identifier mobility option. the type value <5> has been allocated from the registry "Access Network Information (ANI) Sub-Option Type Values" ✨.
  • this specification defines a new Access Network Identifier sub-option called the ANI Update-Timer sub-option ⏰. it's described in Section 3.3, and it can be carried in the Access Network Identifier mobility option. the type value <6> has been allocated from the registry "Access Network Information (ANI) Sub-Option Type Values" 🦋.

6. Security Considerations 🔐

bestie, this section is SERIOUS 😭, so listen up.

the Civic-Location sub-option defined in this spec is carried in the Access Network Identifier option from [RFC6757]. it rides in PBU and PBA messages 📨. it's carried just like any other Access Network Identifier sub-option defined in [RFC6757]. so it inherits its security guidelines from [RFC5213] and [RFC6757], and it doesn't need any extra security considerations 💅.

BUT. the Civic-Location sub-option exposes the civic location of the network the mobile node is attached to 🚨. that info is considered VERY sensitive, so you have to be careful about securing the Proxy Mobile IPv6 signaling messages when this sub-option is carried 🙈. the base Proxy Mobile IPv6 specification ([RFC5213]) specifies IPsec for securing signaling messages, and those mechanisms can be turned on to protect this information 🔒. operators can potentially apply IPsec Encapsulating Security Payload (ESP) with confidentiality and integrity protection to protect the location information 🛡️. the other way to protect users' sensitive location info is, of course, to not send it in the first place 💀. users of the Civic-Location sub-option should provision location values at the highest possible level of granularity, e.g., to the province or city level rather than specific addresses 🌸.

the access-network-specific information elements the mobile access gateway sends may have been dynamically learned over DHCP or using other protocols 😬. if proper security mechanisms aren't in place, the exchanged information between the MAG and LMA may be compromised 🫠. that could lead to incorrect service policy enforcement at the LMA and impact other services that depend on this access network information 💥. you can mitigate this threat by making sure the communication path between the mobile access gateway and the access points is properly secured, using IPsec, Transport Layer Security (TLS), or other security protocols 🛡️✨

7. References 📚

7.1. Normative References 💅

Okay so these are the references the spec needs you to have read, bestie. No skipping. 📚

7.2. Informative References 🌈

These ones are super useful for context but they aren't strictly required reading, so no pressure. 🫶

Acknowledgements 🫶

This document was seriously elevated by the many improvements Kent Leung suggested. Iconic contribution, Kent! 👑

Authors' Addresses 🎀

Meet the squad behind this spec. Here are their addresses, exactly as they were written:

Rajesh S. Pazhyannur
Cisco Systems
170 West Tasman Drive
San Jose, California  95134
United States
EMail: rpazhyan@cisco.com
Sebastian Speicher
Cisco Systems
Richtistrasse 7
Wallisellen, Zurich  8304
Switzerland
EMail: sespeich@cisco.com
Sri Gundavelli
Cisco Systems
170 West Tasman Drive
San Jose, California  95134
United States
EMail: sgundave@cisco.com
Jouni Korhonen
Broadcom Corporation
3151 Zanker Road
San Jose, California  95134
United States
EMail: jouni.nospam@gmail.com
John Kaippallimalil
Huawei
5340 Legacy Drive, Suite 175
Plano, Texas  75024
United States
EMail: john.kaippallimalil@huawei.com

That's the whole spec, bestie! 🌈✨ Thanks for hanging in there with me. 💖

📦 where this page comes from