RFC 8045
RADIUS Extensions for IP Port Configuration and Reporting
🎀 RADIUS Extensions for IP Port Configuration and Reporting 🎀
okay bestie, this is RFC 8045 and it's giving networking main character energy 💅✨
RFC number: 8045 🦋 Title: RADIUS Extensions for IP Port Configuration and Reporting Authors: D. Cheng (Huawei), J. Korhonen (Broadcom Corporation), M. Boucadair (Orange), and S. Sivakumar (Cisco Systems) Category: Standards Track 🏆 Date: January 2017 📅 ISSN: 2070-1721 Obsoletes / Updates: this one doesn't obsolete or update any other documents 🙅♀️
Abstract 📝
okay so the vibe is this: this doc defines three new RADIUS attributes 🎀. For devices that implement IP port ranges, these attributes let a RADIUS server configure and report IP transport ports, plus the mapping behavior for specific hosts. You can use this in lots of deployment scenarios, like Carrier-Grade NAT, IPv4/IPv6 translators, Provider WLAN gateways, etc. 🌈 It also maps some RADIUS attributes to IP Flow Information Export (IPFIX) Information Element identifiers, which is honestly so iconic 😭
Status of This Memo 🌸
This is an Internet Standards Track document 🏆.
This document is a product of the Internet Engineering Task Force (IETF) 💖. It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG) ✨. If you want more info on Internet Standards, check out Section 2 of RFC 7841 🧚.
Info about the current status of this document, any errata, and how to give feedback on it lives at http://www.rfc-editor.org/info/rfc8045 🔗.
Copyright Notice 💜
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved 🦋.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, because they describe your rights and restrictions with respect to this document 🫶. Code Components extracted from this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they are provided without warranty as described in the Simplified BSD License 💅.
Table of Contents 🧚
1. Introduction ....................................................4
2. Terminology .....................................................5
2.1. Requirements Language ......................................6
3. Extensions of RADIUS Attributes and TLVs ........................7
3.1. Extended Attributes for IP Ports ...........................7
3.1.1. IP-Port-Limit-Info Attribute ........................7
3.1.2. IP-Port-Range Attribute .............................9
3.1.3. IP-Port-Forwarding-Map Attribute ...................12
3.2. RADIUS TLVs for IP Ports ..................................15
3.2.1. IP-Port-Type TLV ...................................16
3.2.2. IP-Port-Limit TLV ..................................17
3.2.3. IP-Port-Ext-IPv4-Addr TLV ..........................18
3.2.4. IP-Port-Int-IPv4-Addr TLV ..........................19
3.2.5. IP-Port-Int-IPv6-Addr TLV ..........................20
3.2.6. IP-Port-Int-Port TLV ...............................21
3.2.7. IP-Port-Ext-Port TLV ...............................22
3.2.8. IP-Port-Alloc TLV ..................................23
3.2.9. IP-Port-Range-Start TLV ............................24
3.2.10. IP-Port-Range-End TLV .............................25
3.2.11. IP-Port-Local-Id TLV ..............................25
4. Applications, Use Cases, and Examples ..........................27
4.1. Managing CGN Port Behavior Using RADIUS ...................27
4.1.1. Configure IP Port Limit for a User .................27
4.1.2. Report IP Port Allocation/Deallocation .............29
4.1.3. Configure Port Forwarding Mapping ..................31
4.1.4. An Example .........................................33
4.2. Report Assigned Port Set for a Visiting UE ................35
5. Table of Attributes ............................................36
6. Security Considerations ........................................36
7. IANA Considerations ............................................37
7.1. New IPFIX Information Elements ............................37
7.2. New RADIUS Attributes .....................................38
7.3. New RADIUS TLVs ...........................................38
8. References .....................................................39
8.1. Normative References ......................................39
8.2. Informative References ....................................40
Acknowledgments ...................................................43
Authors' Addresses ................................................431. Introduction ✨
so, in a broadband network, customer info is usually stored on a RADIUS server [RFC2865] 🗂️. When a user starts an IP connection request and it gets authorized, the RADIUS server pushes the user's configuration info to the Network Access Server (NAS), which is often called a Broadband Network Gateway (BNG) in broadband access networks 🌐. The Carrier-Grade NAT (CGN) function can also live on the BNG. In this document, the CGN may do NAT from IPv4 Clients to IPv4 Servers (NAT44) [RFC3022], NAT from IPv6 Clients to IPv4 Servers (NAT64) [RFC6146], or Dual-Stack Lite Address Family Transition Router (AFTR) [RFC6333] function 💖. In that case, the CGN IP transport port (e.g., TCP/UDP port) mapping behaviors can be part of the configuration info sent from the RADIUS server to the NAS/BNG 🎀. And as part of the accounting info going the other way, the NAS/BNG may also report the IP port mapping behavior the CGN applied to a user session 📊.
When IP packets traverse the CGN, it performs mapping on the IP transport (e.g., TCP/UDP) source port as required 🦋. An IP transport source port, along with a source IP address, destination IP address, destination port, and protocol identifier (if applicable), uniquely identifies a mapping 🔑. Here's the tea: the number space of IP transport ports in the CGN's external realm is shared among multiple users who are assigned the same IPv4 address. So a user's total number of simultaneous IP mappings is likely to be subject to a port quota (see Section 5 of [RFC6269]) 🚧.
The attributes defined in this document may also be used to report the assigned port range in some deployments, such as Provider WLAN [WIFI-SERVICES] 📶. For example, a visiting host can be managed by Customer Premises Equipment (CPE), which will need to report the assigned port range to the service platform. This is required for identification purposes (see TR-146 [TR-146] for more details) 🪪.
This document proposes three new attributes as RADIUS protocol extensions 🎉. They're used for separate purposes, as follows:
IP-Port-Limit-Info: This attribute may be carried in a RADIUSAccess-Accept,Access-Request,Accounting-Request, orCoA-Requestpacket. Its purpose is to limit the total number of IP source transport ports allocated to a user and associated with one or more IPv4 or IPv6 addresses 🚦.IP-Port-Range: This attribute may be carried in a RADIUSAccounting-Requestpacket. Its purpose is for an address-sharing device (e.g., a CGN) to report to the RADIUS server the range of IP source transport ports that have been allocated or deallocated for a user. The port range is bound to an external IPv4 address 📦.IP-Port-Forwarding-Map: This attribute may be carried in a RADIUSAccess-Accept,Access-Request,Accounting-Request, orCoA-Requestpacket. Its purpose is to specify how an IP internal source transport port, together with its internal IPv4 or IPv6 address, is mapped to an external source transport port along with the external IPv4 address 🗺️.
IPFIX Information Elements [RFC7012] can be used for IP flow identification and representation over RADIUS 🧩. This document provides a mapping between some RADIUS TLVs and IPFIX Information Element identifiers. A new IPFIX Information Element is defined by this document (see Section 3.2.2) 🫶.
IP protocol numbers (refer to [ProtocolNumbers]) can be used to identify IP transport protocols that are associated with some RADIUS attributes 🔢. Those include TCP [RFC793], UDP [RFC768], Datagram Congestion Control Protocol (DCCP) [RFC4340], and Stream Control Transmission Protocol (SCTP) [RFC4960] 🌊.
This document focuses on IPv4 address sharing. Mechanisms for IPv6 prefix sharing (e.g., IPv6-to-IPv6 Network Prefix Translation (NPTv6)) are out of scope 🙈.
2. Terminology ✨
okay bestie, first we need our vocab locked in 🔑 this doc uses these terms:
- IP Port 🔌: an IP transport port, like a TCP port number or a UDP port number.
- IP Port Type 🏷️: the IP transport protocol, identified by its IP transport protocol number. Check [ProtocolNumbers] for the list.
- IP Port Limit 🚧: the max number of IP ports for one specific protocol (or for all of them) that a port-range-capable device can use when mapping ports for a specific user or host. This limit is usually tied to one or more IPv4 or IPv6 addresses.
- IP Port Range 📏: a set of contiguous IP ports, described by the lowest number and the highest number, both included.
- Internal IP Address 🏠: the IP address a host uses as the source address on an outbound packet heading toward a port-range-capable device in the internal realm. It can be IPv4 or IPv6.
- External IP Address 🌍: the IP address that becomes the source address on an outbound packet after it goes through a port-range-capable device into the external realm. This document assumes the external IP address is an IPv4 address.
- Internal Port 🚪: an IP transport port that a host or app behind an address-sharing device allocates for an outbound packet in the internal realm.
- External Port 🚀: an IP transport port the address-sharing device allocates when it gets an outbound packet from the internal realm. It replaces the internal port that a user or app picked.
- External Realm 🌐: the network segment where external IP addresses are used as source addresses on outbound packets that an address-sharing device forwards.
- Internal Realm 🏡: the network segment behind an address-sharing device, where internal IP addresses are used.
- Mapping 🧩: a relationship between an internal IP address, internal port, and protocol, and an external IP address, external port, and protocol. It's giving matchmaker energy 💘
- Address-Sharing Device 🤝: a device that can share one IPv4 address among multiple users. Typical examples are a CGN, a CPE, a Provider WLAN gateway, etc.
2.1. Requirements Language 📜
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be read as described in RFC 2119 [RFC2119]. these are the official rule-words, so they're serious business 🧐
3. Extensions of RADIUS Attributes and TLVs 🎀
this section adds three new attributes, which are covered in the subsections below:
- IP-Port-Limit-Info Attribute
- IP-Port-Range Attribute
- IP-Port-Forwarding-Map Attribute
all of these attributes come from the RADIUS "Extended Type" code space, per [RFC6929] 🧃
these attributes, and the TLVs they embed (see Section 3.2), have globally unique names and follow the guidelines in Section 2.7.1 of [RFC6929]. in every figure that shows the RADIUS attribute and TLV formats in the subsections below, fields go left to right ➡️
3.1. Extended Attributes for IP Ports 🔌
3.1.1. IP-Port-Limit-Info Attribute 🚧
this attribute is type "tlv" as defined in the RADIUS Protocol Extensions [RFC6929]. it holds some sub-attributes, and the rules are:
- The IP-Port-Limit-Info Attribute MAY contain the IP-Port-Type TLV (see Section 3.2.1).
- The IP-Port-Limit-Info Attribute MUST contain the IP-Port-Limit TLV (see Section 3.2.2).
- The IP-Port-Limit-Info Attribute MAY contain the IP-Port-Ext-IPv4-Addr TLV (see Section 3.2.3).
the IP-Port-Limit-Info Attribute gives the max number of IP ports (from the IP-Port-Limit TLV) for one specific IP transport protocol (from the IP-Port-Type TLV), tied to a given IPv4 address (from the IP-Port-Ext-IPv4-Addr TLV), for an end user. it's basically a little limit card 🃏
quick note: if the IP-Port-Type TLV isn't in the IP-Port-Limit-Info Attribute, the port limit covers all IP transport protocols 🌈
also, if the IP-Port-Ext-IPv4-Addr TLV isn't in there, the port limit covers all the IPv4 addresses managed by the address-sharing device, like a CGN or NAT64 device 🫶
the IP-Port-Limit-Info Attribute MAY show up in an Access-Accept packet. it MAY also show up in an Access-Request packet as a preferred max number of IP ports, given by the port-range-capable device sitting with the NAS (like a CGN or NAT64) 💅
the IP-Port-Limit-Info Attribute MAY show up in a CoA-Request packet.
the IP-Port-Limit-Info Attribute MAY show up in an Accounting-Request packet.
the IP-Port-Limit-Info Attribute MUST NOT show up in any other RADIUS packet. no crashing other people's party 🙅♀️
here's the format of the IP-Port-Limit-Info Attribute, shown in Figure 1:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Extended-Type | Value ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1here's what each field means 🧁
Type: 241
Length: this field gives the total length in octets of all fields in this attribute, including the Type, Length, Extended-Type, and the full length of the embedded TLVs.
Extended-Type: 5
Value: this field holds a set of TLVs, like so:
- IP-Port-Type TLV: holds a value that says which IP port type it is. see Section 3.2.1.
- IP-Port-Limit TLV: holds the max number of IP ports for a specific IP port type, tied to a given IPv4 address for an end user. this TLV MUST be included in the IP-Port-Limit-Info Attribute. see Section 3.2.2. this limit covers all the mappings that the underlying address-sharing device can set up without asking any external entity. so ports that an Authentication, Authorization, and Accounting (AAA) server tells it to use are NOT counted 🙈
- IP-Port-Ext-IPv4-Addr TLV: holds the IPv4 address linked to the IP port limit in the IP-Port-Limit TLV. this TLV is optionally included in the IP-Port-Limit-Info Attribute. see Section 3.2.3.
the IP-Port-Limit-Info Attribute is associated with the following identifier: 241.5. ✨
3.1.2. IP-Port-Range Attribute 📏
this attribute is type "tlv" as defined in the RADIUS Protocol Extensions [RFC6929]. it holds some sub-attributes, and the rules are:
- The IP-Port-Range Attribute MAY contain the IP-Port-Type TLV (see Section 3.2.1).
- The IP-Port-Range Attribute MUST contain the IP-Port-Alloc TLV (see Section 3.2.8).
- For port allocation, the IP-Port-Range Attribute MUST contain both the IP-Port-Range-Start TLV (see Section 3.2.9) and the IP-Port-Range-End TLV (see Section 3.2.10). For port deallocation, the IP-Port-Range Attribute MAY contain both of these two TLVs. if the two TLVs are NOT included, it means that all ports that were previously allocated are now deallocated 🧹
- The IP-Port-Range Attribute MAY contain the IP-Port-Ext-IPv4-Addr TLV (see Section 3.2.3).
- The IP-Port-Range Attribute MAY contain the IP-Port-Local-Id TLV (see Section 3.2.11).
the IP-Port-Range Attribute holds a range of contiguous IP ports. depending on the Value in the IP-Port-Alloc TLV, these ports are either being allocated or deallocated 🔄
if the IP-Port-Type TLV is in the IP-Port-Range Attribute, the port range is tied to the specific IP transport protocol named in that TLV. otherwise, it's for all IP transport protocols 🌈
if the IP-Port-Ext-IPv4-Addr TLV is in the IP-Port-Range Attribute, the port range is tied to the IPv4 address it names. otherwise, it's for all IPv4 addresses that the address-sharing device (like a CGN) uses for the end user 🏡
this attribute can also carry a single IP transport port number. in that case, the Value of the IP-Port-Range-Start TLV and the Value of the IP-Port-Range-End TLV both hold that same port number 💖
the info in the IP-Port-Range Attribute is sent to the RADIUS server 📨
the IP-Port-Range Attribute MAY show up in an Accounting-Request packet.
the IP-Port-Range Attribute MUST NOT show up in any other RADIUS packet. same rule as before, no gatecrashing 🚫
here's the format of the IP-Port-Range Attribute, shown in Figure 2:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Extended-Type | Value ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2the field breakdown 🍓
Type: 241
Length: this field gives the total length in octets of all fields in this attribute, including the Type, Length, Extended-Type, and the full length of the embedded TLVs.
Extended-Type: 6
Value: this field holds a set of TLVs, like so:
- IP-Port-Type TLV: holds a value that says which IP port type it is. see Section 3.2.1.
- IP-Port-Alloc TLV: holds a flag that says whether the specified IP port range is for allocation or deallocation. this TLV MUST be included as part of the IP-Port-Range Attribute. see Section 3.2.8.
- IP-Port-Range-Start TLV: holds the smallest port number in a range of contiguous IP ports. to report a port allocation, this TLV MUST be included together with the IP-Port-Range-End TLV as part of the IP-Port-Range Attribute. see Section 3.2.9.
- IP-Port-Range-End TLV: holds the largest port number in a range of contiguous IP ports. to report a port allocation, this TLV MUST be included together with the IP-Port-Range-Start TLV as part of the IP-Port-Range Attribute. see Section 3.2.10.
- IP-Port-Ext-IPv4-Addr TLV: holds the IPv4 address linked to the IP port range, which is collectively given by the IP-Port-Range-Start TLV and the IP-Port-Range-End TLV. this TLV is optionally included as part of the IP-Port-Range Attribute. see Section 3.2.3.
- IP-Port-Local-Id TLV: holds a local significant identifier at the customer premise, such as a Media Access Control (MAC) address, interface ID, VLAN ID, PPP session ID, VPN Routing and Forwarding (VRF) ID, IP address/prefix, etc. this TLV is optionally included as part of the IP-Port-Range Attribute. see Section 3.2.11.
the IP-Port-Range Attribute is associated with the following identifier: 241.6. 🦋
3.1.3. IP-Port-Forwarding-Map Attribute 🦋
okay bestie, this one is the boss of the 3.1 family 👑 It's type "tlv" (defined in the RADIUS Protocol Extensions [RFC6929]), so it's basically a container full of sub-attributes. Here's the checklist for what goes inside 💅
- The IP-Port-Forwarding-Map Attribute MAY contain the IP-Port-Type TLV (see Section 3.2.1).
- The IP-Port-Forwarding-Map Attribute MUST contain both the IP-Port-Int-Port TLV (see Section 3.2.6) and the IP-Port-Ext-Port TLV (see Section 3.2.7). 🫶
- If the internal realm is with an IPv4 address family, the IP-Port-Forwarding-Map Attribute MUST contain the IP-Port-Int-IPv4-Addr TLV (see Section 3.2.4). If the internal realm is with an IPv6 address family, it MUST contain the IP-Port-Int-IPv6-Addr TLV (see Section 3.2.5). So it's one or the other, depending on the realm 🌈
- The IP-Port-Forwarding-Map Attribute MAY contain the IP-Port-Ext-IPv4-Addr TLV (see Section 3.2.3).
- The IP-Port-Forwarding-Map Attribute MAY contain the IP-Port-Local-Id TLV (see Section 3.2.11).
Now the vibes. The attribute holds a two-octet IP internal port number and a two-octet IP external port number 🍓 The internal port number is tied to an internal IPv4 or IPv6 address that MUST always be included, no exceptions, no cap. The external port number is tied to a specific external IPv4 address if one is included. If it isn't, the external port number is tied to all external IPv4 addresses for the end user 🌸
If the IP-Port-Type TLV is included in the IP-Port-Forwarding-Map Attribute, the port mapping is associated with the specific IP transport protocol named in that TLV. If it isn't included, the mapping is for all IP transport protocols ✨
Where this attribute can show up is also a whole thing 🙈 It MAY appear in an Access-Accept packet. It MAY also appear in an Access-Request packet, which is how the device co-located with the NAS can ask for a preferred port mapping. Just know that the server is not required to honor such a preference, so it's more of a wish than a guarantee 🥺
It MAY appear in a CoA-Request packet too, and it MAY also appear in an Accounting-Request packet. But it MUST NOT appear in any other RADIUS packet. That's a hard no 🚫💀
Here's the format, looking super clean 🧚
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Extended-Type | Value ....
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3Type
241
Length
This field indicates the total length in octets of all fields of this attribute, including the Type, Length, Extended-Type, and the entire length of the embedded TLVs. It's the whole package, babe 🎀
Extended-Type
7
Value
This field contains a set of TLVs, and they go like this 💖
- IP-Port-Type TLV: This TLV contains a value that indicates the IP port type. Refer to Section 3.2.1.
- IP-Port-Int-Port TLV: This TLV contains an internal IP port number associated with an internal IPv4 or IPv6 address. This TLV MUST be included together with the IP-Port-Ext-Port TLV as part of the IP-Port-Forwarding-Map Attribute. Refer to Section 3.2.6. 🔥
- IP-Port-Ext-Port TLV: This TLV contains an external IP port number associated with an external IPv4 address. This TLV MUST be included together with the IP-Port-Int-Port TLV as part of the IP-Port-Forwarding-Map Attribute. Refer to Section 3.2.7. 🔥
- IP-Port-Int-IPv4-Addr TLV: This TLV contains an IPv4 address that is associated with the internal IP port number in the IP-Port-Int-Port TLV. For the internal realm with an IPv4 address family, this TLV MUST be included as part of the IP-Port-Forwarding-Map Attribute. Refer to Section 3.2.4.
- IP-Port-Int-IPv6-Addr TLV: This TLV contains an IPv6 address that is associated with the internal IP port number in the IP-Port-Int-Port TLV. For the internal realm with an IPv6 address family, this TLV MUST be included as part of the IP-Port-Forwarding-Map Attribute. Refer to Section 3.2.5. 🌈
- IP-Port-Ext-IPv4-Addr TLV: This TLV contains an IPv4 address that is associated with the external IP port number in the IP-Port-Ext-Port TLV. This TLV MAY be included as part of the IP-Port-Forwarding-Map Attribute. Refer to Section 3.2.3.
- IP-Port-Local-Id TLV: This TLV contains a local significant identifier at the customer premise, such as MAC address, interface ID, VLAN ID, PPP sessions ID, VRF ID, IP address/prefix, etc. This TLV is optionally included as part of the IP-Port-Forwarding-Map Attribute. Refer to Section 3.2.11. 🧚
The IP-Port-Forwarding-Map Attribute is associated with the following identifier: 241.7. That's its ID card 🪪💜
3.2. RADIUS TLVs for IP Ports 🌷
The TLVs that go inside the three attributes (see Section 3.1) are defined in the subsections below. These TLVs use the format defined in [RFC6929]. Since the three attributes carry similar data, we defined one shared set of TLVs for all of them. That means the TLVs have the same name and number no matter which of the three parent attributes they're tucked into. See Sections 3.1.1, 3.1.2, and 3.1.3 for the list of which TLV is allowed inside which parent attribute 🗂️
The encoding of the Value field of these TLVs follows the recommendation of [RFC6158]. In particular, IP-Port-Type, IP-Port-Limit, IP-Port-Int-Port, IP-Port-Ext-Port, IP-Port-Alloc, IP-Port-Range-Start, and IP-Port-Range-End TLVs are encoded in 32 bits, as per the recommendation in Appendix A.2.1 of [RFC6158] 🎀
3.2.1. IP-Port-Type TLV 🦋
The format of the IP-Port-Type TLV is shown in Figure 4. This attribute carries the IP transport protocol number defined by IANA (refer to [ProtocolNumbers]) 🌈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV-Type | Length | Protocol-Number
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Protocol-Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 4TLV-Type
1
Length
Six octets
Protocol-Number
Integer. This field contains the data (unsigned8) of the protocol number defined in [ProtocolNumbers], right justified, and the unused bits in this field MUST be set to zero. Protocols that do not use a port number (e.g., the Resource Reservation Protocol (RSVP) or IP Encapsulating Security Payload (ESP)) MUST NOT be included in the IP-Port-Type TLV. Rules are rules, bestie 📏
The IP-Port-Type TLV MAY be included in the following attributes:
- IP-Port-Limit-Info Attribute, identified as 241.5.1 (see Section 3.1.1)
- IP-Port-Range Attribute, identified as 241.6.1 (see Section 3.1.2)
- IP-Port-Forwarding-Map Attribute, identified as 241.7.1 (see Section 3.1.3)
When the IP-Port-Type TLV is included within a RADIUS attribute, the associated attribute is applied to the IP transport protocol indicated by the Protocol-Number only, such as TCP, UDP, SCTP, DCCP, etc. So it's one protocol at a time, no mixing 💅
3.2.2. IP-Port-Limit TLV 🧁
The format of the IP-Port-Limit TLV is shown in Figure 5. This attribute carries IPFIX Information Element 458, "sourceTransportPortsLimit", which indicates the maximum number of IP transport ports as a limit for an end user to use that is associated with one or more IPv4 or IPv6 addresses 🔢
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV-Type | Length | sourceTransportPortsLimit
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
sourceTransportPortsLimit |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 5TLV-Type
2
Length
Six octets
sourceTransportPortsLimit
Integer. This field contains the data (unsigned16) of sourceTransportPortsLimit (458) defined in IPFIX, right justified, and the unused bits in this field MUST be set to zero.
The IP-Port-Limit TLV MUST be included as part of the IP-Port-Limit-Info Attribute (refer to Section 3.1.1), identified as 241.5.2. No skipping this one 🙅♀️
3.2.3. IP-Port-Ext-IPv4-Addr TLV 🌸
The format of the IP-Port-Ext-IPv4-Addr TLV is shown in Figure 6. This attribute carries IPFIX Information Element 225, "postNATSourceIPv4Address", which is the IPv4 source address after NAT operation (refer to [IPFIX]) 🌐
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV-Type | Length | postNATSourceIPv4Address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
postNATSourceIPv4Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 6TLV-Type
3
Length
Six octets
postNATSourceIPv4Address
Integer. This field contains the data (ipv4Address) of postNATSourceIPv4Address (225) defined in IPFIX.
The IP-Port-Ext-IPv4-Addr TLV MAY be included in the following attributes:
- IP-Port-Limit-Info Attribute, identified as 241.5.3 (see Section 3.1.1)
- IP-Port-Range Attribute, identified as 241.6.3 (see Section 3.1.2)
- IP-Port-Forwarding-Mapping Attribute, identified as 241.7.3 (see Section 3.1.3)
3.2.4. IP-Port-Int-IPv4-Addr TLV 🎀
The format of the IP-Port-Int-IPv4 TLV is shown in Figure 7. This attribute carries IPFIX Information Element 8, "sourceIPv4Address", which is the IPv4 source address before NAT operation (refer to [IPFIX]) 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV-Type | Length | sourceIPv4Address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
sourceIPv4Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 7TLV-Type
4
Length
Six octets
sourceIPv4Address
Integer. This field contains the data (ipv4Address) of sourceIPv4Address (8) defined in IPFIX.
If the internal realm is with an IPv4 address family, the IP-Port-Int-IPv4-Addr TLV MUST be included as part of the IP-Port-Forwarding-Map Attribute (refer to Section 3.1.3), identified as 241.7.4. It's a must-have for IPv4 realms, so don't forget it 💖
3.2.5. IP-Port-Int-IPv6-Addr TLV 🌐
okay so this TLV carries IPFIX Information Element 27, "sourceIPv6Address" 💅 which is the IPv6 source address before NAT happens (see [IPFIX] if you want the deep dive 🤓). Here's how it's laid out:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV-Type | Length | sourceIPv6Address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
sourceIPv6Address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
sourceIPv6Address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
sourceIPv6Address
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
sourceIPv6Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 8
- TLV-Type:
5 - Length: Eighteen octets
- sourceIPv6Address: IPv6 address (128 bits). This field contains the data (ipv6Address) of sourceIPv6Address (27) defined in IPFIX.
⚠️ If the internal realm is with an IPv6 address family, the IP-Port-Int-IPv6-Addr TLV MUST be included as part of the IP-Port-Forwarding-Map Attribute (refer to Section 3.1.3), identified as 241.7.5. This one's not optional, bestie 🫶
3.2.6. IP-Port-Int-Port TLV 🔌
this one carries IPFIX Information Element 7, "sourceTransportPort", which is the source transport number tied to an internal IPv4 or IPv6 address (see [IPFIX]) 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV-Type | Length | sourceTransportPort
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
sourceTransportPort |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 9
- TLV-Type:
6 - Length: Six octets
- sourceTransportPort: Integer. This field contains the data (unsigned16) of sourceTransportPort (7) defined in IPFIX, right justified, and unused bits MUST be set to zero.
IP-Port-Int-Port TLV MUST be included as part of the IP-Port-Forwarding-Map Attribute (refer to Section 3.1.3), identified as 241.7.6. 💖
3.2.7. IP-Port-Ext-Port TLV 🌸
the vibe here is IPFIX Information Element 227, "postNAPTSourceTransportPort", which is the transport number tied to an external IPv4 address (see [IPFIX]) ✨
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV-Type | Length | postNAPTSourceTransportPort
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
postNAPTSourceTransportPort |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 10
- TLV-Type:
7 - Length: Six octets
- postNAPTSourceTransportPort: Integer. This field contains the data (unsigned16) of postNAPTSourceTransportPort (227) defined in IPFIX, right justified, and unused bits MUST be set to zero.
IP-Port-Ext-Port TLV MUST be included as part of the IP-Port-Forwarding-Map Attribute (refer to Section 3.1.3), identified as 241.7.7. 🎀
3.2.8. IP-Port-Alloc TLV 🍓
this TLV carries IPFIX Information Element 230, "natEvent", which is a flag that says what NAT action is happening (see [IPFIX]) 🧚
so when natEvent is "1" (Create event), it means allocate a range of transport ports 🎉. When it's "2", it means deallocate a range of transports ports 🙈. For this TLV, no other value is used, so don't go making up new ones bestie 💅
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV-Type | Length | natEvent
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
natEvent |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 11
- TLV-Type:
8 - Length: Six octets
- natEvent: Integer. This field contains the data (unsigned8) of natEvent (230) defined in IPFIX, right justified, and unused bits MUST be set to zero. It indicates the allocation or deallocation of a range of IP ports as follows:
0: Reserved
1: Allocation
2: DeallocationIP-Port-Alloc TLV MUST be included as part of the IP-Port-Range Attribute (refer to Section 3.1.2), identified as 241.6.8. 💜
3.2.9. IP-Port-Range-Start TLV 🌈
this one carries IPFIX Information Element 361, "portRangeStart", which is the smallest port number in a range of contiguous transport ports (see [IPFIX]) 👑
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV-Type | Length | portRangeStart
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
portRangeStart |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 12
- TLV-Type:
9 - Length: Six octets
- portRangeStart: Integer. This field contains the data (unsigned16) of portRangeStart (361) defined in IPFIX, right justified, and unused bits MUST be set to zero.
IP-Port-Range-Start TLV is included as part of the IP-Port-Range Attribute (refer to Section 3.1.2), identified as 241.6.9. 🦋
3.2.10. IP-Port-Range-End TLV 🫧
okay so this is the other end of the range: IPFIX Information Element 362, "portRangeEnd", which is the largest port number in a range of contiguous transport ports (see [IPFIX]) 💖
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV-Type | Length | portRangeEnd
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
portRangeEnd |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 13
- TLV-Type:
10 - Length: Six octets
- portRangeEnd: Integer. This field contains the data (unsigned16) of portRangeEnd (362) defined in IPFIX, right justified, and unused bits MUST be set to zero.
IP-Port-Range-End TLV is included as part of the IP-Port-Range Attribute (refer to Section 3.1.2), identified as 241.6.10. 🍓
3.2.11. IP-Port-Local-Id TLV 🪪
this TLV carries a string called "localID", which is a local significant identifier (more on that below) 🧠
here's the tea ☕. There are CGN deployments that don't tell internal hosts apart by their internal IP address alone. They use extra identifiers to pin down which subscriber is which 👀 For example, that happens if a CGN supports overlapping private or shared IP address spaces (as described in [RFC1918] and [RFC6598]) for internal hosts from different subscribers. In those cases, internal hosts get identified and mapped at the CGN by their IP address and/or another identifier, like the identifier of a tunnel between the CGN and the subscriber 🔐 In these scenarios (and similar ones), the internal IP address alone isn't enough to demultiplex connections from internal hosts 😭 So an extra identifier has to show up in the IP-Port-Range Attribute and IP-Port-Forwarding-Mapping Attribute to uniquely identify an internal host. That's the job of the IP-Port-Local-Id TLV 🫶
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TLV-Type | Length | localID ....
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 14
- TLV-Type:
11 - Length: Variable number of octets
- localID: String. The data type of this field is string (refer to [RFC8044]). This field contains the data that is a local significant identifier at the customer premise, such as MAC address, interface ID, VLAN ID, PPP sessions ID, VRF ID, IP address/prefix, or another local significant identifier.
IP-Port-Local-Id TLV MAY be included in the following Attributes if it is necessary to identify the subscriber:
- IP-Port-Range Attribute, identified as 241.6.11 (see Section 3.1.2)
- IP-Port-Forwarding-Mapping Attribute, identified as 241.7.11 (see Section 3.1.3)
4. Applications, Use Cases, and Examples 🎬
this section walks through some applications and use cases to show how the attributes from this document actually get used ✨
4.1. Managing CGN Port Behavior Using RADIUS 📡
okay picture this 🏠 In a broadband network, customer info usually lives on a RADIUS server, and the BNG acts as a NAS. The NAS and the RADIUS server start talking when a user signs in to the Internet service, where either PPP or DHCP/DHCPv6 is used 💅 When a user signs in, the NAS sends a RADIUS Access-Request message to the RADIUS server. The RADIUS server validates the request, and if the validation succeeds, it sends back a RADIUS Access-Accept message. That Access-Accept carries configuration info specific to that user back to the NAS, where some of it gets passed along to the user via PPP or DHCP/DHCPv6 🎀
a CGN function in a broadband network is most likely co-located on a BNG 🤝 In that case, the parameters for CGN port mapping behavior for users can be configured on the RADIUS server. When a user signs in, those parameters can be conveyed to the NAS, and the CGN device gets configured properly for that user 🌸
also, CGN operation status (like CGN port allocation and deallocation for a specific user on the BNG) can be sent back to the RADIUS server for accounting purposes, using the RADIUS protocol 📊
and the RADIUS protocol is already widely deployed in broadband networks to manage BNGs, so the functionality in this specification adds little overhead to the existing network operation 🙌 literally a glow-up with no extra baggage 💜
in the following subsections, we'll look at how to manage CGN behavior using the RADIUS protocol, with the required RADIUS extensions proposed in Section 3 🦋
4.1.1. Configure IP Port Limit for a User 💖
okay so bestie, picture this 🎀 an IPv4 address shortage is basically a group chat where everybody's fighting over one hotspot 📱 so people are proposing to share a bunch of IPv4 addresses between tons of users, using stuff like Carrier Grade NAT [RFC6888], Dual-Stack Lite [RFC6333], NAT64 [RFC6146], etc. 🦋 That means one single public IPv4 address can end up serving hundreds or even thousands of users at once 😭 As indicated in [RFC6269], we literally NEED to put limits on how many ports one user can grab, so the shared address stays available for everyone else using it 🫶 [RFC6888] also lists the port limit as a requirement for CGN, so it's not optional lore, it's a rule 💅
The IP port limit for a user can cover the total number of IP source transport ports, or just a specific IP transport protocol as defined in Section 3.1.1 🌸
The per-user IP port limit gets configured on a RADIUS server, right alongside other user info like credentials 🔐
When a user signs in successfully, the RADIUS server passes the subscriber's IP port limit to the BNG 🌈 The BNG is acting as a NAS and is co-located with the CGN, and it gets the limit through the IP-Port-Limit-Info RADIUS attribute (defined in Section 3.1.1) along with other config parameters ✨ Some parameters go to the user, but the IP port limit gets recorded on the CGN device so it can enforce how many IP transport ports that user is allowed to use 👑
Figure 15 shows how RADIUS is used to set the max number of TCP/UDP ports for a given user on a CGN device 🧚
User CGN/NAS AAA
| BNG Server
| | |
| | |
|----Service Request------>| |
| | |
| |-----Access-Request -------->|
| | |
| |<----Access-Accept-----------|
| | (IP-Port-Limit-Info) |
| | (for TCP/UDP ports) |
|<---Service Granted ------| |
| (other parameters) | |
| | |
| (CGN external port |
| allocation and |
| IPv4 address assignment) |
| | |Figure 15: RADIUS Message Flow for Configuring CGN Port Limit
The IP port limit that a RADIUS extension created on a CGN device for a specific user can be changed later 🔄 You do this with a RADIUS CoA message [RFC5176] that carries the same RADIUS attribute ✨ The CoA message can go straight from the RADIUS server to the NAS, and once a RADIUS CoA ACK message is accepted and sent back, the new IP port limit replaces the old one 💫
Figure 16 shows how RADIUS bumps a user's TCP/UDP port limit from 1024 to 2048 on a CGN device 🚀
User CGN/NAS AAA
| BNG Server
| | |
| TCP/UDP Port Limit (1024) |
| | |
| |<---------CoA Request----------|
| | (IP-Port-Limit-Info) |
| | (for TCP/UDP ports) |
| | |
| TCP/UDP Port Limit (2048) |
| | |
| |---------CoA Response--------->|
| | |Figure 16: RADIUS Message Flow for Changing a User's CGN Port Limit
4.1.2. Report IP Port Allocation/Deallocation 🎀
okay now the fun part 🦋 once the CGN device has the user's IP port limit, it has to allocate an IP transport port for that user whenever a new IP flow comes in from them 💅
One practice is that a CGN may allocate a whole block of IP ports for a specific user, instead of handing them out one at a time 🍓 Within each block, the ports may be randomly distributed or in consecutive order 🌈 When a CGN device allocates a block of transport ports, it can easily tell the RADIUS server about it using a new RADIUS attribute called the IP-Port-Range (defined in Section 3.1.2) ✨ The CGN device may allocate one or more IP port ranges, where each range is a set of numbers representing IP transport ports, and the total number of ports MUST be less than or equal to the associated IP port limit for that user 🚫 A CGN device can choose to allocate a small port range first and grab more later when it's needed, and that's a good move because of its randomization in nature 🧚
At the same time, the CGN device also has to decide on the shared IPv4 address for that user 🌸 The shared IPv4 address and the pre-allocated IP port range both get passed to the RADIUS server 💜
When a user starts an IP flow, the CGN device randomly picks a transport port number from that user's associated, pre-allocated IP port range 🎲 It swaps in that port number for the original source port, and swaps the source IP address for the shared IPv4 address 🦋
A CGN device may decide to "free" a previously assigned set of IP ports that were allocated for a specific user but aren't currently in use 🫧 When it does, the CGN device MUST send the info about the deallocated IP port range, along with the shared IPv4 address, to the RADIUS server 🔥
Figure 17 shows how RADIUS is used to report a set of ports that a NAT64 device allocated and deallocated for a specific user 🌈 2001:db8:100:200::/56 is the IPv6 prefix allocated to this user 💖 To keep NAT64 resources fair across users (see REQ-4 of [RFC6888]), port range allocations are bound to the /56 prefix, not to the source IPv6 address of the request 🫶 The NAT64 device is configured with the per-user port limit policy by some means (e.g., subscriber-mask [RFC7785]) ✨
Host NAT64/NAS AAA
| BNG Server
| | |
| | |
|----Service Request------>| |
| | |
| |-----Access-Request -------->|
| | |
| |<----Access-Accept-----------|
|<---Service Granted ------| |
| (other parameters) | |
... ... ...
| | |
| | |
| (NAT64 decides to allocate |
| a TCP/UDP port range for the user) |
| | |
| |-----Accounting-Request----->|
| | (IP-Port-Range |
| | for allocation) |
... ... ...
| | |
| (NAT64 decides to deallocate |
| a TCP/UDP port range for the user) |
| | |
| |-----Accounting-Request----->|
| | (IP-Port-Range |
| | for deallocation) |
| | |Figure 17: RADIUS Message Flow for Reporting NAT64 Allocation/Deallocation of a Port Set
4.1.3. Configure Port Forwarding Mapping ✨
okay so normally the port mapping on a NAT device just pops into existence when an IP connection starts from a user's side 🌸 but for some apps you need the mapping to already be set up, so packets from outside the CGN device can get through and be "port forwarded" to the right user behind it 🦋
The Port Control Protocol (PCP) [RFC6887] can make a mapping from an external IP address and port to an internal IP address and port on a CGN device, and that's literally what "port forwarding" is 💅 PCP is a server-client protocol that can create or delete mappings dynamically and has a whole bunch of features on a CGN device. But in some setups all a user needs is a few pre-configured mappings (usually just one) for home apps like a web cam 📷 The lifetime of that mapping stays valid for the whole time the customer's Internet service connection is up. In that kind of environment, you can statically configure the port mapping on the RADIUS server for a user, and let the RADIUS protocol pass the info along to the associated CGN device 🫶
Note that this document is about deployments where an AAA server is in charge of instructing NAT mappings for a given subscriber 💜 It doesn't assume anything about the host's abilities when it comes to controlling port forwarding. This is complementary to PCP, since PCP is for a different setup, where an application on the host controls its own mappings in an upstream CPE, CGN, firewall, etc. Totally different vibes, but they work together 🧚
Figure 18 shows how the RADIUS protocol is used to configure a port forwarding mapping on a NAT44 device 🎀
Host CGN/NAS AAA
| BNG Server
| | |
|----Service Request------>| |
| | |
| |---------Access-Request------->|
| | |
| |<--------Access-Accept---------|
| | (IP-Port-Forwarding-Map) |
|<---Service Granted ------| |
| (other parameters) | |
| | |
| (Create a port mapping |
| for the user, and |
| associate it with the |
| internal IP address |
| and external IP address) |
| | |
| | |
| |------Accounting-Request------>|
| | (IP-Port-Forwarding-Map) |
Figure 18: RADIUS Message Flow for Configuring
a Port Forwarding MappingA port forwarding mapping that the CGN device created using the RADIUS extension above can also be changed later with a RADIUS CoA message [RFC5176] that carries the same RADIUS association 🔥 The CoA message can be sent from the RADIUS server straight to the NAS. Once the RADIUS CoA ACK message is accepted and sent back, the new port forwarding mapping replaces the old one 👑
Figure 19 shows how the RADIUS protocol changes an existing port mapping from (a:X) to (a:Y) 🦋 Here "a" is an internal port, and "X" and "Y" are external ports, for one specific user with one specific IP address 🌈
Host CGN/NAS AAA
| BNG Server
| | |
| Internal IP Address |
| Port Map (a:X) |
| | |
| |<---------CoA Request----------|
| | (IP-Port-Forwarding-Map) |
| | |
| Internal IP Address |
| Port Map (a:Y) |
| | |
| |---------CoA Response--------->|
| | (IP-Port-Forwarding-Map) |
Figure 19: RADIUS Message Flow for Changing
a User's Port Forwarding Mapping4.1.4. An Example 🧁
Okay, story time with Joe 🙈 An Internet Service Provider (ISP) gives the user Joe 500 TCP/UDP ports. That's the limit for TCP/UDP ports on a CGN device for Joe, and it's configured on a RADIUS server. Joe also wants a pre-defined port forwarding mapping for his web cam apps, so external port 5000 maps to internal port 1234 📸
Once Joe successfully connects to the Internet service, the RADIUS server passes the TCP/UDP port limit (500) and the port forwarding mapping (external port 5000 to internal port 1234) to the CGN device. It uses the IP-Port-Limit-Info Attribute and the IP-Port-Forwarding-Map Attribute for that, each carried by an Access-Accept message to the BNG, where the NAS and CGN are co-located 💖
When the first outbound IP packet leaves Joe's laptop, the CGN device decides to allocate a small port pool with 40 consecutive ports, from 3500 to 3540 inclusive. It also gives Joe the shared IPv4 address 192.0.2.15 🌸 The CGN device then randomly picks one port from that range (say, 3519) and uses it to replace the original source port in outbound IP packets 🎀
For accounting, the CGN device sends this port range (3500-3540) and the shared IPv4 address 192.0.2.15 together to the RADIUS server, using the IP-Port-Range Attribute carried by an Accounting-Request message 📊
Joe starts using more apps with more outbound IP mappings, and the port pool (3500-3540) is almost used up 😭 So the CGN device allocates a second port pool (8500-8800) in a similar way. It also sends the new port range (8500-8800) and IPv4 address 192.0.2.15 to the RADIUS server, using the IP-Port-Range Attribute in an Accounting-Request message. Note that when the CGN allocates more ports, it needs to make sure the total number of ports allocated for Joe stays within the limit 💅
Joe decides to upgrade his service plan to allow more TCP/UDP ports (up to 1000 ports) ✨ The ISP updates Joe's profile on the RADIUS server, which then sends a CoA-Request message carrying the IP-Port-Limit-Info Attribute with 1000 ports to the CGN device. The CGN device sends back a CoA-ACK message. And just like that, Joe has more ports for his apps 🌈
When Joe isn't using the service, most of his IP mappings are closed and their TCP/UDP ports are released on the CGN device 🍓 The CGN device then sends the relevant info back to the RADIUS server with the IP-Port-Range Attribute carried by the Accounting-Request message.
The whole time Joe is connected to his ISP, apps can talk to his web cam at home from the external realm 🦋 They go straight through the pre-configured mapping on the CGN device, no cap 🙌
When Joe disconnects from his Internet service, the CGN device deallocates all of his TCP/UDP ports, as well as the port forwarding mapping, and sends the relevant info to the RADIUS server 💀
4.2. Report Assigned Port Set for a Visiting UE 🧚
Figure 20 shows an example of the message flow when a visiting User Equipment (UE) connects to a CPE that offers WLAN service 📶
For identification purposes (see [RFC6967]), once the CPE assigns a port set, it sends a RADIUS message to report the assigned port set 🫶
UE CPE CGN AAA
| BNG Server
| | |
| | |
|----Service Request------>| |
| | |
| |-----Access-Request -------->|
| | |
| |<----Access-Accept-----------|
|<---Service Granted ------| |
| (other parameters) | |
... | ... ...
|<---IP@----| | |
| | | |
| (CPE assigns a TCP/UDP port |
| range for this visiting UE) |
| | |
| |--Accounting-Request-...------------------->|
| | (IP-Port-Range |
| | for allocation) |
... | ... ...
| | | |
| | | |
| (CPE withdraws a TCP/UDP port |
| range for a visiting UE) |
| | |
| |--Accounting-Request-...------------------->|
| | (IP-Port-Range |
| | for deallocation) |
| | |
Figure 20: RADIUS Message Flow for Reporting CPE
Allocation/Deallocation of a Port Set to a Visiting UE5. Table of Attributes 📋
This document proposes three new RADIUS attributes 🎉 Their formats are:
- IP-Port-Limit-Info: 241.5
- IP-Port-Range: 241.6
- IP-Port-Forwarding-Map: 241.7
The table below is a guide to which types of RADIUS packets may contain these attributes, and how many of each 💜
Request Accept Reject Challenge Acct. # Attribute
Request
0+ 0+ 0 0 0+ 241.5 IP-Port-Limit-Info
0 0 0 0 0+ 241.6 IP-Port-Range
0+ 0+ 0 0 0+ 241.7 IP-Port-Forwarding-MapThe table below defines what the entries in the table above mean 🙈
0 This attribute MUST NOT be present in packet.
0+ Zero or more instances of this attribute MAY be present in packet.6. Security Considerations 🔐
okay bestie, this section is SERIOUS 😭 but also it's giving "the protocol has some trust issues and we need to talk about them" 💅
This document does not introduce any security issue other than the ones already identified in RADIUS documents [RFC2865] and [RFC5176] for CoA messages. Known RADIUS vulnerabilities apply to this specification. For example, if RADIUS packets are sent in the clear, an attacker in the communication path between the RADIUS client and server may glean information that it will use to prevent a legitimate user from accessing the service by appropriately setting the maximum number of IP ports conveyed in an IP-Port-Limit-Info Attribute; exhaust the port quota of a user by installing many mapping entries (IP-Port-Forwarding-Map Attribute); prevent incoming traffic from being delivered to its legitimate destination by manipulating the mapping entries installed by means of an IP-Port-Forwarding-Map Attribute; discover the IP address and port range that are assigned to a given user and reported in an IP-Port-Range Attribute; and so on. The root cause of these attack vectors is the communication between the RADIUS client and server. 🫣
The attacker list is long and honestly kind of spicy 🌶️:
- Setting the max ports in an IP-Port-Limit-Info Attribute to lock a user out 🚫
- Installing a pile of mapping entries (IP-Port-Forwarding-Map Attribute) to drain someone's port quota 💀
- Messing with IP-Port-Forwarding-Map entries so incoming traffic never reaches the right destination 📦
- Snooping the IP address and port range in an IP-Port-Range Attribute 👀
- And so on 🙈
The root cause is the RADIUS client-to-server communication, so that's the spot to guard. 🛡️
The IP-Port-Local-Id TLV includes an identifier whose type and length are deployment and implementation dependent. This identifier might carry privacy-sensitive information. It is therefore RECOMMENDED to utilize identifiers that do not have such privacy concerns. 🙈🫶
If there is any error in a RADIUS Accounting-Request packet sent from a RADIUS client to the server, the RADIUS server MUST NOT send a response to the client (refer to [RFC2866]). Examples of the errors include the erroneous port range in the IP-Port-Range Attribute, inconsistent port mapping in the IP-Port-Forwarding-Map Attribute, etc. 🚫📨
This document targets deployments where a trusted relationship is in place between the RADIUS client and server with communication optionally secured by IPsec or Transport Layer Security (TLS) [RFC6614]. 🔒💜
7. IANA Considerations 🧚
okay so IANA gets to do some registry admin here ✨ Per this document, IANA has made new code point assignments for both IPFIX Information Elements and RADIUS attributes as explained in the following subsections.
7.1. New IPFIX Information Elements 🦋
The following IPFIX Information Element has been registered (refer to Section 3.2.2):
- sourceTransportPortsLimit:
- Name: sourceTransportPortsLimit
- Element ID: 458
- Description: This Information Element contains the maximum number of IP source transport ports that can be used by an end user when sending IP packets; each user is associated with one or more (source) IPv4 or IPv6 addresses. This Information Element is particularly useful in address-sharing deployments that adhere to REQ-4 of [RFC6888]. Limiting the number of ports assigned to each user ensures fairness among users and mitigates the denial-of-service attack that a user could launch against other users through the address-sharing device in order to grab more ports. 💅✨
- Data type: unsigned16
- Data type semantics: totalCounter
- Data type unit: ports
- Data value range: from 1 to 65535
7.2. New RADIUS Attributes 🎀
The Attribute Types defined in this document have been registered by IANA from the RADIUS namespace as described in the "IANA Considerations" section of [RFC3575], in accordance with BCP 26 [RFC5226]. For RADIUS packets, attributes, and registries created by this document, IANA has placed them at <http://www.iana.org/assignments/radius-types>.
In particular, this document defines three new RADIUS attributes, as follows, from the Short Extended Space of [RFC6929] 🌈:
Type Description Data Type Reference
---- ----------- --------- ---------
241.5 IP-Port-Limit-Info tlv Section 3.1.1
241.6 IP-Port-Range tlv Section 3.1.2
241.7 IP-Port-Forwarding-Map tlv Section 3.1.37.3. New RADIUS TLVs 🍓
IANA has created a new registry called "RADIUS IP Port Configuration and Reporting TLVs". All TLVs in this registry have one or more parent RADIUS attributes in nesting (refer to [RFC6929]). This registry contains the following TLVs:
Value Description Data Type Reference
----- ----------- --------- ---------
0 Reserved
1 IP-Port-Type integer Section 3.2.1
2 IP-Port-Limit integer Section 3.2.2
3 IP-Port-Ext-IPv4-Addr ipv4addr Section 3.2.3
4 IP-Port-Int-IPv4-Addr ipv4addr Section 3.2.4
5 IP-Port-Int-IPv6-Addr ipv4addr Section 3.2.5
6 IP-Port-Int-Port integer Section 3.2.6
7 IP-Port-Ext-Port integer Section 3.2.7
8 IP-Port-Alloc integer Section 3.2.8
9 IP-Port-Range-Start integer Section 3.2.9
10 IP-Port-Range-End integer Section 3.2.10
11 IP-Port-Local-Id string Section 3.2.11
12-255 UnassignedThe registration procedure for this registry is Standards Action as defined in [RFC5226]. 📋
8. References 📚
8.1. Normative References 🔥
- [IPFIX] IANA, "IP Flow Information Export (IPFIX) Entities", <http://www.iana.org/assignments/ipfix/>.
- [ProtocolNumbers] IANA, "Protocol Numbers", <http://www.iana.org/assignments/protocol-numbers/>.
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <http://www.rfc-editor.org/info/rfc2119>.
- [RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson, "Remote Authentication Dial In User Service (RADIUS)", RFC 2865, DOI 10.17487/RFC2865, June 2000, <http://www.rfc-editor.org/info/rfc2865>.
- [RFC3575] Aboba, B., "IANA Considerations for RADIUS (Remote Authentication Dial In User Service)", RFC 3575, DOI 10.17487/RFC3575, July 2003, <http://www.rfc-editor.org/info/rfc3575>.
- [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, DOI 10.17487/RFC5226, May 2008, <http://www.rfc-editor.org/info/rfc5226>.
- [RFC6929] DeKok, A. and A. Lior, "Remote Authentication Dial In User Service (RADIUS) Protocol Extensions", RFC 6929, DOI 10.17487/RFC6929, April 2013, <http://www.rfc-editor.org/info/rfc6929>.
- [RFC7012] Claise, B., Ed., and B. Trammell, Ed., "Information Model for IP Flow Information Export (IPFIX)", RFC 7012, DOI 10.17487/RFC7012, September 2013, <http://www.rfc-editor.org/info/rfc7012>.
- [RFC8044] DeKok, A., "Data Types in RADIUS", RFC 8044, DOI 10.17487/RFC8044, January 2017, <http://www.rfc-editor.org/info/rfc8044>.
8.2. Informative References ✨
Okay bestie, these are the informative references, the "go read this if you want more" list 📚🎀 None of them are required to implement this spec, but they're the good stuff for context.
[RFC768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, DOI 10.17487/RFC0768, August 1980, <http://www.rfc-editor.org/info/rfc768>. 🌸
[RFC793] Postel, J., "Transmission Control Protocol", STD 7, RFC 793, DOI 10.17487/RFC0793, September 1981, <http://www.rfc-editor.org/info/rfc793>. 🦋
[RFC1918] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G., and E. Lear, "Address Allocation for Private Internets", BCP 5, RFC 1918, DOI 10.17487/RFC1918, February 1996, <http://www.rfc-editor.org/info/rfc1918>. The private address classic 💅
[RFC2866] Rigney, C., "RADIUS Accounting", RFC 2866, DOI 10.17487/RFC2866, June 2000, <http://www.rfc-editor.org/info/rfc2866>. 🧚
[RFC3022] Srisuresh, P. and K. Egevang, "Traditional IP Network Address Translator (Traditional NAT)", RFC 3022, DOI 10.17487/RFC3022, January 2001, <http://www.rfc-editor.org/info/rfc3022>. The OG NAT doc 👑
[RFC4340] Kohler, E., Handley, M., and S. Floyd, "Datagram Congestion Control Protocol (DCCP)", RFC 4340, DOI 10.17487/RFC4340, March 2006, <http://www.rfc-editor.org/info/rfc4340>. 💜
[RFC4960] Stewart, R., Ed., "Stream Control Transmission Protocol", RFC 4960, DOI 10.17487/RFC4960, September 2007, <http://www.rfc-editor.org/info/rfc4960>. 🍓
[RFC5176] Chiba, M., Dommety, G., Eklund, M., Mitton, D., and B. Aboba, "Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)", RFC 5176, DOI 10.17487/RFC5176, January 2008, <http://www.rfc-editor.org/info/rfc5176>. 🔥
[RFC6146] Bagnulo, M., Matthews, P., and I. van Beijnum, "Stateful NAT64: Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers", RFC 6146, DOI 10.17487/RFC6146, April 2011, <http://www.rfc-editor.org/info/rfc6146>. 🌈
[RFC6158] DeKok, A., Ed., and G. Weber, "RADIUS Design Guidelines", BCP 158, RFC 6158, DOI 10.17487/RFC6158, March 2011, <http://www.rfc-editor.org/info/rfc6158>. ⭐
[RFC6269] Ford, M., Ed., Boucadair, M., Durand, A., Levis, P., and P. Roberts, "Issues with IP Address Sharing", RFC 6269, DOI 10.17487/RFC6269, June 2011, <http://www.rfc-editor.org/info/rfc6269>. The "why is address sharing so messy" read 🙈
[RFC6333] Durand, A., Droms, R., Woodyatt, J., and Y. Lee, "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion", RFC 6333, DOI 10.17487/RFC6333, August 2011, <http://www.rfc-editor.org/info/rfc6333>. 🎀
[RFC6598] Weil, J., Kuarsingh, V., Donley, C., Liljenstolpe, C., and M. Azinger, "IANA-Reserved IPv4 Prefix for Shared Address Space", BCP 153, RFC 6598, DOI 10.17487/RFC6598, April 2012, <http://www.rfc-editor.org/info/rfc6598>. Shared address space, iconic ✨
[RFC6614] Winter, S., McCauley, M., Venaas, S., and K. Wierenga, "Transport Layer Security (TLS) Encryption for RADIUS", RFC 6614, DOI 10.17487/RFC6614, May 2012, <http://www.rfc-editor.org/info/rfc6614>. 🔐💖
[RFC6887] Wing, D., Ed., Cheshire, S., Boucadair, M., Penno, R., and P. Selkirk, "Port Control Protocol (PCP)", RFC 6887, DOI 10.17487/RFC6887, April 2013, <http://www.rfc-editor.org/info/rfc6887>. The PCP doc, obviously 🦋✨
[RFC6888] Perreault, S., Ed., Yamagata, I., Miyakawa, S., Nakagawa, A., and H. Ashida, "Common Requirements for Carrier-Grade NATs (CGNs)", BCP 127, RFC 6888, DOI 10.17487/RFC6888, April 2013, <http://www.rfc-editor.org/info/rfc6888>. 💅
[RFC6967] Boucadair, M., Touch, J., Levis, P., and R. Penno, "Analysis of Potential Solutions for Revealing a Host Identifier (HOST_ID) in Shared Address Deployments", RFC 6967, DOI 10.17487/RFC6967, June 2013, <http://www.rfc-editor.org/info/rfc6967>. 🌸
[RFC7785] Vinapamula, S. and M. Boucadair, "Recommendations for Prefix Binding in the Context of Softwire Dual-Stack Lite", RFC 7785, DOI 10.17487/RFC7785, February 2016, <http://www.rfc-editor.org/info/rfc7785>. 🧚
[TR-146] Broadband Forum, "TR-146: Subscriber Sessions", Broadband Forum Technical Report 146, Issue 1, May 2013, <http://www.broadband-forum.org/technical/download/TR-146.pdf>. 📡
[WIFI-SERVICES] Gundavelli, S., Grayson, M., Seite, P., and Y. Lee, "Service Provider Wi-Fi Services Over Residential Architectures", Work in Progress, draft-gundavelli-v6ops-community-wifi-svcs-06, April 2013. This one's still a draft, so it's giving "watch this space" 👀
Acknowledgments 🫶
Huge thank-yous to Dan Wing, Roberta Maglione, Daniel Derksen, David Thaler, Alan DeKok, Lionel Morand, and Peter Deacon for their super useful comments and suggestions. You all made this so much better 💖
Special shoutout to Lionel Morand for the Shepherd review and to Kathleen Moriarty for the AD review 👑
Thanks also to Carl Wallace, Tim Chown, and Ben Campbell for the detailed review 🌈
Authors' Addresses ✨
Dean Cheng Huawei 2330 Central Expressway Santa Clara, California 95050 United States of America
Email: dean.cheng@huawei.com
Jouni Korhonen Broadcom Corporation 3151 Zanker Road San Jose, California 95134 United States of America
Email: jouni.nospam@gmail.com
Mohamed Boucadair Orange Rennes France
Email: mohamed.boucadair@orange.com
Senthil Sivakumar Cisco Systems 7100-8 Kit Creek Road Research Triangle Park, North Carolina United States of America
Email: ssenthil@cisco.com
That's the whole doc, bestie 🎀💅
📦 where this page comes from
- ietf: rfc8045 2017-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms