RFC 7756
Stateless IP/ICMP Translation for IPv6 Internet Data Center Environments (SIIT-DC): Dual Translation Mode
RFC 7756: Stateless IP/ICMP Translation for IPv6 Internet Data Center Environments (SIIT-DC): Dual Translation Mode 🎀✨
okay bestie, so this is the one that explains how to make IPv4-only stuff work in an IPv6-only data center, and it's giving main character energy 💅🦋
Who wrote it: T. Anderson (Redpill Linpro) and S. Steffann (S.J.M. Steffann Consultancy) 🫶
Category: Informational 🌸. This is NOT a standards-track spec, it's published just to share info. Still, it went through IETF community review and got approved by the IESG, so it's very much legit 💜
Date: February 2016 📅
Obsoletes / Updates: The original header doesn't list either of these, so this doc doesn't obsolete or update anything 🧚
ISSN: 2070-1721 🔥
The whole point is the Dual Translation Mode extension to SIIT-DC, which lets IPv4-only stuff, IPv6-incompatible stuff, and anything that can't do NAT run properly. It does this with a brand new piece called the SIIT-DC Edge Relay, which basically undoes what the SIIT-DC Border Relay did. So the app thinks it has real IPv4 internet, and the IPs stay end-to-end transparent 😭✨
You need to know RFC 7755 first, the SIIT-DC architecture, so go read that if you haven't 📚🌈
Status of This Memo 🍓
This doc is not an Internet Standards Track spec. It's just for info purposes, bestie 🌸
BUT it's still a product of the IETF, it represents the consensus of the IETF community, got public review, and was approved by the IESG. Not every IESG-approved doc is a candidate for any Internet Standard level, though. For the deets, check Section 2 of RFC 5741 💅
Errata, current status, and feedback info live at http://www.rfc-editor.org/info/rfc7756 🦋
Copyright Notice 💜
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. 🎀
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as of the publication date. Read them carefully, because they spell out your rights and restrictions 🫶
If you pull Code Components out of this doc, they have to include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They come without warranty, same as the Simplified BSD License says 🔥
Table of Contents 🌈
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Edge Relay Description . . . . . . . . . . . . . . . . . . . 5
3.1. Node-Based Edge Relay . . . . . . . . . . . . . . . . . . 6
3.2. Network-Based Edge Relay . . . . . . . . . . . . . . . . 7
3.2.1. Edge Relay "on a Stick" . . . . . . . . . . . . . . . 8
3.2.2. Edge Relay That Bridges IPv6 Packets . . . . . . . . 9
4. Deployment Considerations . . . . . . . . . . . . . . . . . . 9
4.1. IPv6 Path MTU . . . . . . . . . . . . . . . . . . . . . . 9
4.2. IPv4 MTU . . . . . . . . . . . . . . . . . . . . . . . . 10
4.3. IPv4 Identification Header . . . . . . . . . . . . . . . 10
5. Intra-IDC IPv4 Communication . . . . . . . . . . . . . . . . 10
5.1. Hairpinning by the SIIT-DC Border Relay . . . . . . . . . 11
5.2. Additional EAMs Configured in Edge Relay . . . . . . . . 12
6. Security Considerations . . . . . . . . . . . . . . . . . . . 13
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 14
7.1. Normative References . . . . . . . . . . . . . . . . . . 14
7.2. Informative References . . . . . . . . . . . . . . . . . 14
Appendix A. Examples: Network-Based IPv4 Connectivity . . . . . 16
A.1. Subnet with IPv4 Service Addresses . . . . . . . . . . . 16
A.2. Subnet with Unrouted IPv4 Addresses . . . . . . . . . . . 16
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 17
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 171. Introduction ✨
SIIT-DC [RFC7755] is the architecture where IPv4-only users reach IPv6-only services through a stateless translator called the SIIT-DC Border Relay (BR). Cute, but it has some limits 🙈 The following cases work badly or not at all:
- Application protocols that don't support NAT, meaning they don't have end-to-end transparency of IP addresses 💀
- Nodes that can't connect to IPv6 networks at all, or can only do it if they also have IPv4 (aka dual-stacked networks) 😭
- Application software that uses legacy IPv4-only APIs or just assumes IPv4 connectivity is there 🥲
So the fix is adding a new component called the Edge Relay (ER). With it, all of the above can work in an otherwise IPv6-only SIIT-DC network 🦋
The ER's job is to reverse the IPv4-to-IPv6 translations the BR already did for traffic from IPv4 clients, then forward it to the node or app as "native" IPv4 🎀 Going the other way, the ER catches the IPv4 packets the node or app sends, translates them to IPv6 before they go to the BR, and the BR reverses things and sends them back to the IPv4 client. So the node gets "virtual" IPv4 Internet connectivity that keeps the IPv4 addresses end-to-end transparent 💖
2. Terminology 📚
This doc uses these terms:
SIIT-DC Border Relay (BR): A device or logical function that does stateless protocol translation between IPv4 and IPv6. It MUST do this in accordance with [RFC6145] and [RFC7757]. 🔥
SIIT-DC Edge Relay (ER): A device or logical function that gives "native" IPv4 connectivity to IPv4-only devices or app software. It works a lot like a BR, but it usually sits close to the IPv4-only component(s) it supports, not on the outer network border of the Internet Data Center (IDC). An ER can be node based (Section 3.1) or network based (Section 3.2). 🧚
IPv4 Service Address: An IPv4 address that represents a node or service in an IPv6 network. It's coupled with an IPv6 Service Address using an Explicit Address Mapping (EAM). Packets sent to this address get translated to IPv6 by the BR, and maybe back to IPv4 by an ER, before they reach the node or service 💅
IPv6 Service Address: An IPv6 address assigned to an application, node, or service, either directly or indirectly (through an ER). It's coupled with an IPv4 Service Address using an EAM. IPv4-only clients talk to the IPv6 Service Address through SIIT-DC 🌸
Explicit Address Mapping (EAM): A bidirectional coupling between an IPv4 Service Address and an IPv6 Service Address, configured in a BR or ER. When translating between IPv4 and IPv6, the BR/ER changes the address fields in the translated packet's IP header according to any matching EAM. The EAM algorithm is specified in [RFC7757]. 🦋
Translation Prefix: An IPv6 prefix that the entire IPv4 address space gets mapped into, using the algorithm in [RFC6052]. The translation prefix is routed to the BR's IPv6 interface. When translating between IPv4 and IPv6, a BR/ER inserts or removes the translation prefix in the address fields of the translated packet's IP header, UNLESS there's an EAM for the IP address being translated. 💜
IPv4-Converted IPv6 Addresses: As defined in Section 1.3 of [RFC6052]. 🌈
IDC: Short for "Internet Data Center": a data center whose main purpose is delivering services to the public Internet. SIIT-DC is mainly meant for deployment in an IDC. An IDC is usually run by an Internet Content Provider or a Managed Services Provider. 🍓
SIIT: The Stateless IP/ICMP Translation Algorithm, as specified in [RFC6145]. ✨
XLAT: Short for "Translation". It's used in figures to show where a BR/ER uses SIIT [RFC6145] to translate IPv4 packets to IPv6 and back. 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 🫶
3. Edge Relay Description 🌸
At its core, an ER is an implementation of the Stateless IP/ICMP Translation Algorithm [RFC6145] that supports Explicit Address Mappings [RFC7757]. It gives virtual IPv4 connectivity to nodes or apps that need it to work with SIIT-DC 💖
Packets from the IPv4 Internet headed to an IPv4 Service Address first get translated to IPv6 by a BR. Those IPv6 packets then get forwarded to the ER that owns the IPv6 Service Address they're addressed to. The ER translates them back to IPv4 and forwards them to the IPv4 app or node. In the other direction, the exact same translations happen, just in reverse. This is how end-to-end transparency of IPv4 addresses is kept 🦋
An ER can handle any number of IPv4/IPv6 Service Addresses. ALL the EAMs configured in the BR that involve the IPv4/IPv6 Service Addresses an ER handles MUST ALSO be present in the ER's configuration. 🔥
An ER can be implemented two ways: as a software-based service living inside an otherwise IPv6-only node, or as a network-based service that provides an isolated IPv4 network segment that IPv4-needing nodes can connect to. In both cases, native IPv6 connectivity can be provided at the same time as the virtual IPv4 connectivity, so dual-stack connectivity is possible if the node or app supports it 🧚
The choice between a node-based and a network-based ER is made per service or per node. Any number of each type of ER can coexist in an SIIT-DC architecture 👑
This section goes over the different approaches and talks about which one fits best for the various use cases 💅
3.1. Node-Based Edge Relay
[IPv4 Internet] [IPv6 Internet]
| |
+-----|-----+ |
| (BR/XLAT) | |
+-----|-----+ |
| | +-----<IPv6-only node/server>----------+
[IPv6-only IDC network] | +----------------+|
| | /--(ER/XLAT)--AF_INET Dual-stack ||
\-------------------------+ | application ||
| \------------AF_INET6 software ||
| +----------------+|
+--------------------------------------+Figure 1: A Node-Based Edge Relay
Okay so a node-based ER is basically a software function that lives inside the operating system of an IPv6 node 💻✨ Its whole job is giving the apps on that same node IPv4 connectivity, which is iconic. Its IPv4 Service Address SHOULD be treated as a regular local address, so apps can use it with IPv4-only API calls, like making AF_INET sockets that listen for and accept incoming connections to that address 🦋 An ER can pull this off by spinning up a virtual network adapter, giving it the IPv4 Service Address, and pointing a default IPv4 route at it. This is giving "Bump-in-the-Stack" vibes from [RFC6535], except it does not include an Extension Name Resolver 🌸
Now, as shown in Figure 1, if the application is dual-stack, IPv6 clients can talk to it directly over native IPv6. Neither the BR nor the ER steps in to intercept that 💖 Supporting IPv6 in the app is not a requirement though, so the app can totally skip establishing any IPv6 sockets. The only tradeoff is that IPv6-only clients won't be able to reach the service, but IPv4 clients (going through the BR) keep working exactly the same way 🙈
The ER needs a dedicated IPv6 Service Address for each IPv4 Service Address it has configured. The IPv6 network MUST forward traffic for these IPv6 Service Addresses to the node, and the node's operating system MUST in turn forward that traffic to the ER 🔥 This doc doesn't try to dig into all the ways this could happen, but since IPv6 is literally built for a single node having multiple addresses, one super straightforward option is to assign the ER's IPv6 Service Addresses as secondary IPv6 addresses on the node itself. That way the upstream router learns where they are using the IPv6 Neighbor Discovery Protocol [RFC4861] 👑
3.2. Network-Based Edge Relay
[IPv4 Internet] [IPv6 Internet]
| |
+-----|-----+ |
| (BR/XLAT) | |
+-----|-----+ |
| |
[IPv6-only IDC network] +--<IPv4-only node/server>--+
| | +----------------+|
+-----|-----+ [v4-only] | | IPv4-only ||
| (ER/XLAT)-----[network]--------AF_INET application ||
+-----------+ [segment] | | software ||
| +----------------+|
+---------------------------+Figure 2: A Basic Network-Based Edge Relay
A network-based ER works the exact same way as a node-based ER, with one twist 🧚 Instead of giving the IPv4 Service Addresses to an internal-only virtual adapter, the traffic meant for them gets forwarded onto a network segment that the nodes needing IPv4 connectivity plug into. The ER is also the default IPv4 router for the nodes on that segment 🎀
Each node on the IPv4 network segment MUST acquire an IPv4 Service Address and assign it to a local network interface. This doc doesn't try to explore every method for doing that, but Appendix A has some examples 💅
The basic ER in Figure 2 sets up an IPv4-only network segment between itself and the IPv4-only nodes it serves. That's fine if those nodes have zero IPv6 support, but if they're dual-stack capable, taking away their IPv6 connectivity like this is not ideal at all 😭 It is RECOMMENDED to use a node-based ER in this situation, but suitable node-based ER implementations might not exist for every node. And if the application protocol in question doesn't work correctly in a NAT environment, standard SIIT-DC can't be used either, which leaves a network-based ER as the only option left 🥺 The subsections below show examples of how the ER could be built to give dual-stack capable nodes IPv6 connectivity too ✨
3.2.1. Edge Relay "on a Stick"
[IPv4 Internet] [IPv6 Internet]
| |
+-----|-----+ |
| (BR/XLAT) | |
+-----|-----+ |
| |
[IPv6-only IDC network]
|
| +-------------+
| | _IPv6_ |
| | / \ |
+==== (ER/XLAT) |
| | \_ _/ |
| | IPv4 | +--<Dual-stack node/server>--+
| +-------------+ | +----------------+|
| | /---AF_INET Dual-stack ||
[Dual-stack network segment]----< | application ||
| \--AF_INET6 software ||
| +----------------+|
+----------------------------+Figure 3: A Network-Based Edge Relay "on a Stick"
The ER "on a stick" setup in Figure 3 keeps the dual-stack node's native IPv6 connectivity intact 🦋 It does this by hooking the ER's IPv4 and IPv6 interfaces up to the same network segment, or by using a single dual-stacked interface instead. Native IPv6 traffic between the IDC network and the node skips the ER completely. IPv4 traffic from the node goes straight to the ER, since it's the default IPv4 router, and gets translated to IPv6 before heading out to the upstream default IPv6 router 🚀 The ER could also attract inbound traffic to the IPv6 Service Addresses by answering the upstream router's IPv6 Neighbor Discovery [RFC4861] messages about them.
3.2.2. Edge Relay That Bridges IPv6 Packets
[IPv4 Internet] [IPv6 Internet]
| |
+-----|-----+ |
| (BR/XLAT) | |
+-----|-----+ |
| |
[IPv6-only IDC network]
|
+-----------|--------------+
| ____/ \_IPv6_ |
| / \ |
| (IPv6 Bridge) (ER/XLAT) |
| \____ _ _/ |
| \ / IPv4 | +--<Dual-stack node/server>--+
+-----------|--------------+ | +----------------+|
| | /---AF_INET Dual-stack ||
[Dual-stack network segment]----< | application ||
| \--AF_INET6 software ||
| +----------------+|
+----------------------------+Figure 4: A Network-Based Edge Relay Containing an IPv6 Bridge
This one is giving bridge realness 🌉 The ER in Figure 4 transparently bridges IPv6 frames between its upstream and downstream interfaces. IPv6 packets sent from the upstream IDC network to an IPv6 Service Address get intercepted by the ER (for example, by answering IPv6 Neighbor Discovery [RFC4861] messages about them) and run through the translation function. Then they go out the ER's downstream interface as IPv4 packets. So the downstream network segment ends up dual stacked, and honestly that's a whole glow-up 💜
4. Deployment Considerations 🎀
4.1. IPv6 Path MTU
The IPv6 Path MTU between the ER and the BR will typically be larger than the default value defined in Section 4 of [RFC6145] (1280 bytes), since it'll usually sit inside a single administrative domain 🌈 So it is RECOMMENDED that the IPv6 Path MTU configured in the ER gets raised to match. It is also RECOMMENDED that the ER and the BR use identical configured IPv6 Path MTU values 🫶
4.2. IPv4 MTU
To avoid IPv6 fragmentation, an ER SHOULD make sure the IPv4 MTU used by applications or nodes equals the configured IPv6 Path MTU - 20. That way a maximum-sized IPv4 packet fits in an unfragmented IPv6 packet ✨ The application can then do its part in avoiding IP-level fragmentation, for example by segmenting or fragmenting outbound packets at the application layer, and by advertising the maximum size its peer may use for inbound packets (for example, through the TCP Maximum Segment Size (MSS) option) 🍓
A node-based ER could set this MTU value on the virtual network adapter. A network-based ER could do it by advertising the MTU to its downstream nodes using the DHCPv4 Interface MTU option [RFC2132] 💅
4.3. IPv4 Identification Header
If generating IPv6 Atomic Fragments is disabled, the value of the IPv4 Identification header gets lost during translation 💀 But if you turn on IPv6 Atomic Fragment generation, the IPv4 Identification header gets carried end to end. Just note that for this to work in both directions, IPv6 Atomic Fragment generation MUST be enabled on both the BR and the ER 👑
Apart from certain diagnostic tools, there are few (if any) application protocols that use the IPv4 Identification header. So losing the IPv4 Identification value will generally not cause any problems 🦋
IPv6 Atomic Fragments and their impact on the IPv4 Identification header are discussed further in Section 4.9.2 of [RFC7755] 🧚
5. Intra-IDC IPv4 Communication ✨
Although SIIT-DC is mainly meant to help IPv4-only nodes on the Internet talk to services in an IPv6-only IDC network, an IPv4-only node or application behind an ER might need to reach other nodes or services in the IDC too 🌸 That IPv4-only node or app has to go through the ER, since it typically can't contact IPv6 destinations directly. The subsections that follow talk through different ways to make that kind of communication happen 🫶
5.1. Hairpinning by the SIIT-DC Border Relay 🦋
okay so if the BR supports hairpinning as described in Section 4.2 of [RFC7757], the easiest way is to make the target service available through SIIT-DC in the normal way 💅. That means provisioning an EAM to the BR that assigns an IPv4 Service Address with the target service's IPv6 Service Address ✨
this lets the IPv4-only node or app send packets to the target service's IPv4 Service Address. then the ER translates them into a matching IPv4-converted IPv6 address by inserting the translation prefix [RFC6052] 🧚 when that IPv6 packet hits the BR, it gets hairpinned and sent back out to the target service's IPv6 Service Address (where it could possibly pass through another ER before reaching the target service). return traffic from the target service gets hairpinned the same way, so it's giving symmetry 🫶
+-[Pkt#1: IPv4]-+ +--[Pkt#2: IPv6]-------------+
| SRC 192.0.2.1 | (XLAT#1) | SRC 2001:db8:a:: |
| DST 192.0.2.2 |--(@ ER A)-->| DST 2001:db8:46::192.0.2.2 |---\
+---------------+ +----------------------------+ |
(XLAT#2)
+-[Pkt#4: IPv4]-+ +--[Pkt#3: IPv6]-------------+ ( @ BR )
| SRC 192.0.2.1 | (XLAT#3) | SRC 2001:db8:46::192.0.2.1 | |
| DST 192.0.2.2 |<--(@ ER B)--| DST 2001:db8:b:: |<--/
+---------------+ +----------------------------+
Figure 5: Hairpinned IPv4-IPv4 Packet FlowFigure 5 shows a hairpinned packet going from the IPv4-only node/app behind ER A to an IPv6-only node/app behind ER B 👀 ER A is configured with the EAM {192.0.2.1,2001:db8:a::} and ER B with {192.0.2.2,2001:db8:b::}. the BR is configured with both EAMs and supports hairpinning. note: if the target service had not been behind an ER, the third and final translation (XLAT#3) would not have happened. the target service/node would have received and responded to packet #3 directly 🙈
if the IPv4-only nodes/services don't need connectivity with the public IPv4 Internet, private IPv4 addresses [RFC1918] could be used as their IPv4 Service Addresses. that helps the IDC operator save their pool of public IPv4 addresses 🌸
5.2. Additional EAMs Configured in Edge Relay
okay plot twist 😭 if the BR doesn't support hairpinning, or if hairpinning just isn't what you want for some other reason, intra-IDC IPv4 traffic can still work. you configure additional EAMs on the ER for each service the IPv4-only node or app needs to talk to. this makes the IPv6 traffic between the ER and the target service's IPv6 Service Address take the direct path through the IPv6 network. it doesn't pass the BR, so this option might give you better latency than hairpinning 🚀
the extra EAM on the ER is made of the target's IPv6 Service Address and an IPv4 Service Address. the IPv4-only node or app contacts the target's IPv4 Service Address and uses its own IPv4 Service Address as the source. the ER then translates that original IPv4 packet into an IPv6 packet. the source of the new IPv6 packet is the IPv6 Service Address of the local node or app, and the destination is the IPv6 Service Address of the target. any replies from the target get the exact same translation, just reversed 🔁
if the target service is behind another ER, that other ER MUST also be provisioned with an additional EAM that contains the IPv4 and IPv6 Service Addresses of the origin IPv4-only node or application. otherwise, that target's ER can't translate the source address of the incoming packets 😱
+-[Pkt#1: IPv4]-+ +--[Pkt#2: IPv6]---+
| SRC 192.0.2.1 | (XLAT#1) | SRC 2001:db8:a:: |
| DST 192.0.2.2 |--(@ ER A)-->| DST 2001:db8:b:: |
+---------------+ +------------------+
|
+-[Pkt#3: IPv4]-+ |
| SRC 192.0.2.1 | (XLAT#2) |
| DST 192.0.2.2 |<-------(@ ER B)------/
+---------------+
Figure 6: Non-hairpinned IPv4-IPv4 Packet FlowFigure 6 shows a packet carrying intra-IDC IPv4 traffic between two IPv4-only nodes/apps that are both behind ERs 💖 ER A and ER B are both configured with two EAMs: {192.0.2.1,2001:db8:a::} and {192.0.2.2,2001:db8:b::}. the packet follows the regular routing path through the IPv6 IDC network. the BR isn't involved, so the packet doesn't get hairpinned ✨
this approach doesn't cancel out the hairpinning approach from Section 5.1. if both EAMs above are also configured on the BR, then both 192.0.2.1 and 192.0.2.2 are reachable from other IPv4-only services/nodes using the hairpinning approach. they'd also be reachable from the IPv4 Internet 🌈
quick aside: if the target service in this example wasn't behind an ER, but was instead a native IPv6 service listening on 2001:db8:b::, the second translation step in Figure 6 wouldn't happen. the target service would receive and respond to packet #2 directly 🧚
same deal as with hairpinning: if the IPv4-only nodes/services don't need connectivity to or from the public IPv4 Internet, private IPv4 addresses [RFC1918] could be used as their IPv4 Service Addresses. and if the target service is on native IPv6, the target's IPv4 Service Address only has local significance behind the ER. so it could be assigned from the IPv4 Service Continuity Prefix [RFC7335] 🎀
6. Security Considerations 🔐
okay this section is the serious part, bestie 🫣 it talks about security stuff that's specific to using an ER. for security considerations that apply to the SIIT-DC architecture overall, check the Security Considerations section in [RFC7755] 📚
if the ER gets an IPv4 packet from an application/node using a source address it doesn't have an EAM for, both the source and destination addresses get rewritten according to [RFC6052]. after the reverse translation in the BR, the resulting IPv4 packet that gets routed to the IPv4 network has a spoofed IPv4 source address 💀 so the ER SHOULD make sure ingress filtering [RFC2827] is used on the ER's IPv4 interface, so that such packets are immediately discarded 🛑
if the ER gets an IPv6 packet where both the source and destination address are equal to one of its local IPv6 Service Addresses, the resulting packet would look locally generated to the IPv4-only application/node, since the source and destination addresses are the same. this could trick the application into believing the packet came from a trusted source (itself) 😈 to prevent this, the ER SHOULD discard any received IPv6 packets that have a source address that is either 1) equal to any of its local IPv6 Service Addresses or 2) after translation from IPv6 to IPv4, equal to any of its local IPv4 Service Addresses 🔒
7. References 📖
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC7755] Anderson, T., "SIIT-DC: Stateless IP/ICMP Translation for
IPv6 Data Center Environments", RFC 7755,
DOI 10.17487/RFC7755, February 2016,
<http://www.rfc-editor.org/info/rfc7755>.
[RFC7757] Anderson, T. and A. Leiva, "Explicit Address Mappings for
Stateless IP/ICMP Translation", RFC 7757,
DOI 10.17487/RFC7757, February 2016,
<http://www.rfc-editor.org/info/rfc7757>.7.2. Informative References
[RFC826] Plummer, D., "Ethernet Address Resolution Protocol: Or
Converting Network Protocol Addresses to 48.bit Ethernet
Address for Transmission on Ethernet Hardware", STD 37,
RFC 826, DOI 10.17487/RFC0826, November 1982,
<http://www.rfc-editor.org/info/rfc826>.
[RFC1918] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.,
and E. Lear, "Address Allocation for Private Internets",
BCP 5, RFC 1918, DOI 10.17487/RFC1918, February 1996,
<http://www.rfc-editor.org/info/rfc1918>.
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol",
RFC 2131, DOI 10.17487/RFC2131, March 1997,
<http://www.rfc-editor.org/info/rfc2131>.
[RFC2132] Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor
Extensions", RFC 2132, DOI 10.17487/RFC2132, March 1997,
<http://www.rfc-editor.org/info/rfc2132>.
[RFC2827] Ferguson, P. and D. Senie, "Network Ingress Filtering:
Defeating Denial of Service Attacks which employ IP Source
Address Spoofing", BCP 38, RFC 2827, DOI 10.17487/RFC2827,
May 2000, <http://www.rfc-editor.org/info/rfc2827>.
[RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman,
"Neighbor Discovery for IP version 6 (IPv6)", RFC 4861,
DOI 10.17487/RFC4861, September 2007,
<http://www.rfc-editor.org/info/rfc4861>.
[RFC6052] Bao, C., Huitema, C., Bagnulo, M., Boucadair, M., and X.
Li, "IPv6 Addressing of IPv4/IPv6 Translators", RFC 6052,
DOI 10.17487/RFC6052, October 2010,
<http://www.rfc-editor.org/info/rfc6052>.
[RFC6145] Li, X., Bao, C., and F. Baker, "IP/ICMP Translation
Algorithm", RFC 6145, DOI 10.17487/RFC6145, April 2011,
<http://www.rfc-editor.org/info/rfc6145>.
[RFC6535] Huang, B., Deng, H., and T. Savolainen, "Dual-Stack Hosts
Using "Bump-in-the-Host" (BIH)", RFC 6535,
DOI 10.17487/RFC6535, February 2012,
<http://www.rfc-editor.org/info/rfc6535>.
[RFC6724] Thaler, D., Ed., Draves, R., Matsumoto, A., and T. Chown,
"Default Address Selection for Internet Protocol Version 6
(IPv6)", RFC 6724, DOI 10.17487/RFC6724, September 2012,
<http://www.rfc-editor.org/info/rfc6724>.
[RFC6877] Mawatari, M., Kawashima, M., and C. Byrne, "464XLAT:
Combination of Stateful and Stateless Translation",
RFC 6877, DOI 10.17487/RFC6877, April 2013,
<http://www.rfc-editor.org/info/rfc6877>.
[RFC7335] Byrne, C., "IPv4 Service Continuity Prefix", RFC 7335,
DOI 10.17487/RFC7335, August 2014,
<http://www.rfc-editor.org/info/rfc7335>.Appendix A. Examples: Network-Based IPv4 Connectivity ✨
A.1. Subnet with IPv4 Service Addresses 🌸
okay so, the most straightforward way to give IPv4 connectivity between a network-based ER and the IPv4 nodes it serves is to make sure the IPv4 Service Address(es) fit inside a bigger IPv4 prefix 💖 The ER can grab one address from that prefix for itself, use it as the IPv4 default router address, and hand the IPv4 Service Address(es) out to its downstream nodes using DHCPv4 [RFC2131]. For example, if the IPv4 Service Addresses are 192.0.2.26 and 192.0.2.27, the ER would configure 192.0.2.25/29 on its IPv4-facing interface and add the two IPv4 Service Addresses to its DHCPv4 pool ✨
BUT, and this is a big but 🙈, there's a downside. IPv4 communication between the IPv4 nodes behind the ER and other services offered through SIIT-DC becomes impossible if those other services have IPv4 Service Addresses that are also covered by that same prefix (say, 192.0.2.28). The reason is that the IPv4 nodes will think they have an on-link route to the entire prefix, so they'll try to resolve those addresses with ARP [RFC826] instead of sending the traffic to the ER for translation to IPv6. Literally the worst 😭 There are a few ways to fix this. You can avoid assigning IPv4 Service Addresses that overlap with an IPv4 prefix handled by an ER (ngl, that wastes some potential IPv4 Service Addresses). Or you can make sure the overlapping IPv4 Service Addresses only go to services that never need to talk to the IPv4 nodes behind the ER. A third way is covered in Appendix A.2 🦋
A.2. Subnet with Unrouted IPv4 Addresses 🧚
So to dodge the problem from Appendix A.1, you could use a private, unrouted IPv4 network that doesn't include the IPv4 Service Address(es) to connect the ER with the IPv4-only nodes it serves 🎀 An IPv4-only node then has to assign its IPv4 Service Address as a secondary local address, and the ER routes each IPv4 Service Address to its assigned node, using that node's private on-link IPv4 address as the next hop. This keeps the IPv4 Service Addresses from overlapping with anything else in the infrastructure, which is iconic, BUT it also means you can't use DHCPv4 [RFC2131] to assign the IPv4 Service Addresses. Trade-offs, bestie 💅
This setup creates one more thing to check: the IPv4 application has to pick the IPv4 Service Address (and not its private on-link IPv4 address) as its source address when it starts outbound connections. You could make that happen by changing the Default Address Selection Policy Table [RFC6724] on the IPv4 node 🌈
Acknowledgements
okay the authors want to give a huge shoutout to the authors of 464XLAT [RFC6877]: Masataka Mawatari, Masanobu Kawashima, and Cameron Byrne 🫶 The architecture in this document is basically just their work adapted for a data center environment, so none of this would've happened without them 👑
The authors would also like to thank the following people for their contributions, suggestions, corrections, and criticisms: Fred Baker, Tobias Brox, Olafur Gudmundsson, Christer Holmberg, Ray Hunter, Shucheng LIU (Will), and Andrew Yourtchenko 💜 the whole squad 🍓
Authors' Addresses
Here's where you can find the authors 🦋
Tore Anderson
Redpill Linpro
Vitaminveien 1A
0485 Oslo
Norway
Phone: +47 959 31 212
Email: tore@redpill-linpro.com
URI: http://www.redpill-linpro.comSander Steffann
S.J.M. Steffann Consultancy
Tienwoningenweg 46
Apeldoorn, Gelderland 7312 DN
The Netherlands
Email: sander@steffann.nl📦 where this page comes from
- ietf: rfc7756 2016-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms