RFC 8159
Keyed IPv6 Tunnel
RFC 8159: Keyed IPv6 Tunnel 🎀
Okay bestie, this is RFC 8159, called Keyed IPv6 Tunnel, and it came out in May 2017 🦋. It's a Standards Track document (ISSN 2070-1721) from the IETF. The authors are M. Konstantynowicz (Ed.) and G. Heron (Ed.) from Cisco Systems, R. Schatzmayr from Deutsche Telekom AG, and W. Henderickx from Alcatel-Lucent, Inc. The title block doesn't list anything it obsoletes or updates, so it stands on its own ✨
Abstract
This doc describes a tunnel encapsulation for Ethernet over IPv6 with a mandatory 64-bit cookie 🍓 It's for connecting Layer 2 (L2) Ethernet attachment circuits that are identified by IPv6 addresses. The encapsulation is based on the Layer 2 Tunneling Protocol Version 3 (L2TPv3) over IP, but it does not use the L2TPv3 control plane. Iconic, right? 💅
Status of This Memo
This is an Internet Standards Track document 🌸
This doc is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, it got public review, and the Internet Engineering Steering Group (IESG) approved it for publication. If you want more info on Internet Standards, check Section 2 of RFC 7841 🧚
To find out the current status of this document, any errata, or how to send feedback on it, go to http://www.rfc-editor.org/info/rfc8159 💜
Copyright Notice
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved. 🔥
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info), as in effect on the date it was published. Please actually read these, bestie, because they spell out your rights and restrictions for this document 🙈 Any Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They come without warranty, just like the Simplified BSD License says 🫶
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3
2. Static 1:1 Mapping without a Control Plane . . . . . . . . . 3
3. 64-Bit Cookie . . . . . . . . . . . . . . . . . . . . . . . . 4
4. Encapsulation . . . . . . . . . . . . . . . . . . . . . . . . 4
5. Fragmentation and Reassembly . . . . . . . . . . . . . . . . 7
6. OAM Considerations . . . . . . . . . . . . . . . . . . . . . 7
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8
8. Security Considerations . . . . . . . . . . . . . . . . . . . 8
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 9
9.1. Normative References . . . . . . . . . . . . . . . . . . 9
9.2. Informative References . . . . . . . . . . . . . . . . . 10
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 11
Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 121. Introduction ✨
okay so L2TPv3, as defined in [RFC3931], gives you a way to tunnel Layer 2 (L2) "circuits" across a packet-oriented data network (for example, over IP). Lots of attachment circuits get multiplexed over one pair of IP address endpoints, which is what we call a tunnel, and the L2TPv3 Session ID is what tells them apart as circuits 💖
Now, running L2TPv3 over IPv6 [RFC2460] is where it gets lowkey genius. You can use unique IPv6 addresses to identify Ethernet attachment circuits directly, because IPv6 has a massive number of unique IP addresses. That's the main property being leveraged here 👑 Since each tunnel has one and only one associated session, the Session ID processing can be skipped when a packet arrives. It's a local optimization, and it doesn't stop the same router from still multiplexing circuits by Session ID for other L2TPv3 tunnels 🦋
There are a bunch of perks compared to the "traditional" L2TPv3 approach, which terminates the tunnel on a loopback address and then carries multiple sessions through it. First, you get better ECMP load balancing, since every tunnel has its own unique source and destination IPv6 address pair 🌈 Second, you get finer-grained control when you advertise tunnel endpoints with a routing protocol. Main character energy 💅
1.1. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 🎀
2. Static 1:1 Mapping without a Control Plane 🌸
The L2TPv3 control plane from [RFC3931] is not used for this encapsulation at all 🙅 Instead, the management plane creates and maintains matching configurations at each end of every tunnel. Local configuration from the management plane sets up a one-to-one mapping between the access-side L2 attachment circuit and the IP address used in the network-side IPv6 encapsulation 🧚
The IPv6 L2TPv3 tunnel encapsulating device uniquely identifies each Ethernet L2 attachment connection in one of two ways. On the access side, it's a port ID, or a combo of a port ID and VLAN ID(s). On the network side, it's a local IPv6 address. That local IPv6 address also identifies the tunnel endpoint 💜 Now here's the vibe check: local IPv6 addresses that identify L2TPv3 tunnels SHOULD NOT be assigned from connected IPv6 subnets that face the remote tunnel endpoints. The reason is that doing so would create an IPv6 Neighbor Discovery cache entry per tunnel on the next-hop router toward the remote tunnel endpoint, which is way too many entries 🙈 It is RECOMMENDED that local IPv6 addresses identifying L2TPv3 tunnels are assigned from dedicated subnets that are used only for those tunnel endpoints ✨
Some deployments may need a single IPv6 address (like a unicast or anycast address assigned to one specific service instance, for example a virtual switch) to identify a tunnel endpoint for multiple IPv6 L2TPv3 tunnels. In those cases, the tunnel decapsulating device uses the local IPv6 address to identify the service instance, and the remote IPv6 address to identify the individual tunnel inside that service instance 🦋
As I said earlier, Session ID processing is not required, since each keyed IPv6 tunnel has one and only one associated session 🍓 Still, for compatibility with existing [RFC3931] implementations, the packets need to be sent with the Session ID. Routers that implement L2TPv3 according to [RFC3931] can be configured with multiple L2TPv3 tunnels, with one session per tunnel, so they can interoperate with routers that implement the keyed IPv6 tunnel specified by this document 🫶 Also, since Session ID processing is not enabled for keyed IPv6 tunnels, there can only be a single keyed IPv6 tunnel between any two IPv6 addresses 🔥
3. 64-Bit Cookie 🍓
Following [RFC3931], the 64-bit cookie is used for an additional tunnel endpoint context check. It's the largest cookie size [RFC3931] permits 💅 All packets MUST carry the 64-bit L2TPv3 cookie field. The cookie MUST be 64 bits long, because that's what gives enough protection against spoofing and brute-force blind insertion attacks 😭 The cookie values SHOULD be randomly selected 🎲
Without the L2TPv3 control plane, the L2TPv3 encapsulating router MUST be given a local configuration of the 64-bit cookie for each local and remote IPv6 endpoint 🧚 Cookies are asymmetric, so the local and remote endpoints may send different cookie values, and they SHOULD do so, bestie 💖 The cookie value MUST be able to be changed at any time without dropping any legitimate tunneled packets. In other words, the receiver MUST be configurable to accept two discrete cookies for a single tunnel at the same time. That way the receiver can hold both the 'old' and 'new' cookie values while the change happens ✨ Cookie values SHOULD be changed periodically by the management plane 🌈
Mandating a 64-bit cookie is a change from the optional variable-length cookie in [RFC3931]. That means this requirement limits interoperability with existing [RFC3931] implementations to the ones that support a 64-bit cookie 😬 The management plane MUST NOT configure a keyed IP tunnel unless both endpoints support the 64-bit cookie 🚫
4. Encapsulation ✨
Okay so the ingress router wraps up the entire Ethernet frame 🎁 but leaves off the preamble and the Frame Check Sequence (FCS) when it goes into L2TPv3, as per [RFC4719]. The L2-specific sublayer MAY be carried if Virtual Circuit Connectivity Verification (VCCV) [RFC5085] and/or frame sequencing is required, but it SHOULD NOT be carried otherwise. The L2TPv3 packet gets encapsulated directly over IPv6 (aka no UDP header is carried, bye UDP 👋).
The ingress router MAY retain the FCS as per [RFC4720]. Support for retaining the FCS and for receiving packets with a retained FCS is OPTIONAL and, if present, MUST be configurable. Without the L2TPv3 control plane, that configuration MUST be consistent for the two endpoints of any given tunnel. So if one router is set to retain the FCS, the other router MUST be set to receive packets with the retained FCS. Any router that retains FCS for a tunnel MUST retain FCS for all frames sent over that tunnel. Every router implementing this specification MUST support sending frames without retaining the FCS and receiving those frames too. The "it's giving consistency" energy here is immaculate 💅
Any service-delimiting IEEE 802.1Q [IEEE802.1Q] or IEEE 802.1ad [IEEE802.1ad] VLAN IDs (S-tag, C-tag, or the tuple (S-tag, C-tag)) are treated with local significance within the Ethernet L2 port and MUST NOT be forwarded over the IPv6 L2TPv3 tunnel. Those tags stay home 🏠
Note that the same approach may be used to transport protocols other than Ethernet, though this is outside the scope of this specification. 🦋
The full encapsulation looks like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ IPv6 Header (320 bits) +
~ ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Session ID (32 bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cookie (0:31) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cookie (32:63) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| (Optional) L2-Specific Sublayer (32 bits) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| |
| Payload (variable) |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The combined IPv6 and keyed IP tunnel header has these fields:
- IPv6 Header. Here's the tea ☕:
- The traffic class may be set by the ingress router so transit routers between the ingress and egress give the packets the correct Per-Hop Behavior (PHB) treatment, and so the egress router gets the QoS disposition right.
- The flow label, as defined in [RFC6437], may be set by the ingress router to mark a flow of packets from the client that the network may not reorder (for when you need finer-grained ECMP load balancing instead of per-circuit load balancing). Main character flow label 🧚
- The next header will be set to
0x73to say the next header is L2TPv3. - In the "Static 1:1 Mapping" case described in Section 2, the IPv6 source address may correspond to a port or port/VLAN being transported as an L2 circuit. It may also correspond to a virtual interface terminating inside the router, like when L2 circuits are used within a multipoint VPN or when an anycast address is terminated on a set of data-center virtual machines.
- Same deal with the destination address: it may correspond to a port or port/VLAN being transported as an L2 circuit, or to a virtual interface.
- Session ID. In the "Static 1:1 Mapping" case from Section 2, the IPv6 address identifies an L2TPv3 session directly. So at endpoints that support one-stage resolution (IPv6 Address Only), the Session ID SHOULD be ignored upon receipt. It is RECOMMENDED that the remote endpoint is set to use all ones (
0xFFFFFFFF) as the Session ID so it's easy to spot when you're troubleshooting 🔍. For compatibility with other tunnel termination platforms that only support two-stage resolution (IPv6 Address + Session ID), this specification recommends supporting explicit configuration of the Session ID to any value other than zero (including all ones). The Session ID of zero MUST NOT be used, because it's reserved for L2TP control messages as specified in [RFC3931]. Also, the Session ID is unidirectional, so the sent and received Session IDs at an endpoint may be different. Two-way drama not required 🙃 - Cookie. This is the 64-bit cookie, configured and described as in Section 3. All packets for a destined L2 circuit (or L2TPv3 Session) MUST match one of the cookie values configured for that circuit. Any packet that doesn't contain a valid cookie value MUST be discarded (see [RFC3931] for more details). Bouncer energy 🚪
- L2-Specific Sublayer (Optional). As noted above, this is present if VCCV and/or frame sequencing is required. If VCCV is required, any frames with bit 0 (the "V-bit") set are VCCV messages. If frame sequencing is required, any frames with bit 1 (the "S-bit") set have a valid frame sequence number in bits 8-31.
- Payload (variable). As noted above, the preamble and any service-delimiting tags MUST be stripped before encapsulation, and the FCS MUST be stripped unless FCS retention is configured at both the ingress and egress routers. Since a new FCS is added at each hop when the encapsulating IP packet is transmitted, the payload is protected against bit errors. Protected payload is a whole vibe 🛡️
5. Fragmentation and Reassembly ✨
Using tunnel encapsulation of Ethernet L2 datagrams in IPv6 will reduce the effective MTU allowed for the encapsulated traffic. Mood: shrinking room 📉
The recommended solution to this problem is for the network operator to increase the MTU size of all the links between the devices acting as IPv6 L2TPv3 tunnel endpoints. That way they can fit both the IPv6 L2TPv3 encapsulation header and the Ethernet L2 datagram without fragmenting the IPv6 packet. Bigger pipes, no drama 🚰
It is RECOMMENDED that routers implementing this specification implement IPv6 Path MTU (PMTU) discovery as defined in [RFC1981]. That way they can confirm the path has enough MTU to carry a maximum-length Ethernet frame plus the encapsulation overhead. Check the path, bestie 🛣️
Routers implementing this specification MAY implement L2TPv3 fragmentation (as defined in Section 5 of [RFC4623]). Without the L2TPv3 control plane, it is RECOMMENDED that fragmentation (if implemented) is configured locally on a per-tunnel basis. Fragmentation configuration MUST be consistent between the two ends of a tunnel. Both sides have to agree or it's chaos 🌪️
It is NOT RECOMMENDED for routers implementing this specification to enable IPv6 fragmentation (as defined in Section 4.5 of [RFC2460]) for keyed IP tunnels. Not the move, babe 🙅♀️
6. OAM Considerations ✨
Operations, Administration, and Maintenance (OAM) is a big deal when you're providing circuit-oriented services like the ones in this document. It matters even more without a dedicated tunnel control plane, since OAM becomes the only way to detect failures in the tunnel overlay. No OAM, no clue 🕵️
Note that for keyed IP tunnels, failures in the IPv6 underlay network can be detected with the usual methods, like the routing protocol. That includes single-hop Bidirectional Forwarding Detection (BFD) [RFC5881], which catches link failures super fast ⚡. Multihop BFD MAY also be enabled between tunnel endpoints as per [RFC5883].
Keyed IP tunnels always carry an Ethernet payload, and OAM at the tunnel layer can't detect failures in the Ethernet service processing at the ingress or egress router, or on the Ethernet attachment circuit between the router and the Ethernet client. So it is RECOMMENDED that Ethernet OAM as defined in [IEEE802.1ag] and/or [Y.1731] be enabled for keyed IP tunnels. As those specifications define, the following Connectivity Fault Management (CFM) and/or Ethernet Continuity Check (ETH-CC) configurations are used with keyed IPv6 tunnels:
- Connectivity verification between the tunnel endpoints across the tunnel: Use an Up Maintenance End Point (MEP) located at the tunnel endpoint to transmit the CFM PDUs towards the tunnel and receive them from that direction. 🛤️
- Connectivity verification from the tunnel endpoint across the local attachment circuit: Use a Down MEP located at the tunnel endpoint to transmit the CFM PDUs towards the local attachment circuit and receive them from that direction. 🔌
- Intermediate connectivity verification: Use a Maintenance Intermediate Point (MIP) located at the tunnel endpoint to relay CFM PDUs. 🧃
In addition, Pseudowire VCCV [RFC5085] MAY be used. Furthermore, BFD MAY be enabled over the VCCV channel [RFC5885]. Extra layers of checking, iykyk 🫶
Note that since there is no control plane, it is RECOMMENDED that the management plane take action when an attachment circuit failure is detected. For example, it can drop the remote attachment circuit. Cut the cord when it's broken ✂️
7. IANA Considerations ✨
This document does not require any IANA actions. Nothing to register here, it's giving chill 🧘
8. Security Considerations ✨
Okay bestie, this section is SERIOUS. Read every word. 🚨
Packet spoofing for any type of Virtual Private Network (VPN) tunneling protocol is of particular concern. Inserting carefully constructed rogue packets into the VPN transit network could violate VPN traffic separation and leak data into a customer VPN. It's complicated by the fact that the VPN operator may have a hard time even realizing it has become a point of transit into or between customer VPNs. Scary stuff 👻
Keyed IPv6 encapsulation provides traffic separation for its VPNs through separate 128-bit IPv6 addresses that identify the endpoints. The mandatory use of the 64-bit L2TPv3 cookie adds another check, making sure an arriving packet is actually meant for the identified tunnel. Double-checked, no cap 🔐
In the presence of a blind packet-spoofing attack, the 64-bit L2TPv3 cookie protects against inadvertently leaking frames into a customer VPN, as documented in Section 8.2 of [RFC3931]. 💅
For protection against brute-force blind insertion attacks, the 64-bit cookie MUST be used with all tunnels. Every. Single. Tunnel. 🙅♀️
Note that the cookie provides no protection against a sophisticated man-in-the-middle attacker who can sniff and correlate captured data between nodes for use in a coordinated attack. The cookie is not a force field against that, so don't act like it is 🫠
The L2TPv3 64-bit cookie must not be regarded as a substitute for security such as that provided by IPsec when operating over an open or untrusted network, where packets may be sniffed, decoded, and correlated for use in a coordinated attack. Use IPsec on the sketchy networks, babe 🔥
9. References ✨
9.1. Normative References 📚
okay so these are the must-reads, bestie 💅 the specs you need before you can even get started
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6
(IPv6) Specification", RFC 2460, DOI 10.17487/RFC2460,
December 1998, <http://www.rfc-editor.org/info/rfc2460>.
[RFC3931] Lau, J., Ed., Townsley, M., Ed., and I. Goyret, Ed.,
"Layer Two Tunneling Protocol - Version 3 (L2TPv3)",
RFC 3931, DOI 10.17487/RFC3931, March 2005,
<http://www.rfc-editor.org/info/rfc3931>.
[RFC4719] Aggarwal, R., Ed., Townsley, M., Ed., and M. Dos Santos,
Ed., "Transport of Ethernet Frames over Layer 2 Tunneling
Protocol Version 3 (L2TPv3)", RFC 4719,
DOI 10.17487/RFC4719, November 2006,
<http://www.rfc-editor.org/info/rfc4719>.9.2. Informative References 🌸
these ones are the extra reading 🧚 handy to have on hand, not required to build the thing
[IEEE802.1ad]
IEEE, "IEEE Standard for Local and Metropolitan Area
Networks - Virtual Bridged Local Area Networks, Amendment
4: Provider Bridges", IEEE 802.1ad-2005, DOI
10.1109/IEEESTD.2006.216360.
[IEEE802.1ag]
IEEE, "IEEE Standard for Local and metropolitan area
networks - Virtual Bridged Local Area Networks, Amendment
5: Connectivity Fault Management", IEEE 802.1ag-2007, DOI
10.1109/IEEESTD.2007.4431836.
[IEEE802.1Q]
IEEE, "IEEE Standard for Local and metropolitan area
networks - Bridges and Bridged Networks", IEEE 802.1Q-
2014, DOI 10.1109/IEEESTD.2014.6991462.
[RFC1981] McCann, J., Deering, S., and J. Mogul, "Path MTU Discovery
for IP version 6", RFC 1981, DOI 10.17487/RFC1981, August
1996, <http://www.rfc-editor.org/info/rfc1981>.
[RFC4623] Malis, A. and M. Townsley, "Pseudowire Emulation Edge-to-
Edge (PWE3) Fragmentation and Reassembly", RFC 4623,
DOI 10.17487/RFC4623, August 2006,
<http://www.rfc-editor.org/info/rfc4623>.
[RFC4720] Malis, A., Allan, D., and N. Del Regno, "Pseudowire
Emulation Edge-to-Edge (PWE3) Frame Check Sequence
Retention", RFC 4720, DOI 10.17487/RFC4720, November 2006,
<http://www.rfc-editor.org/info/rfc4720>.
[RFC5085] Nadeau, T., Ed. and C. Pignataro, Ed., "Pseudowire Virtual
Circuit Connectivity Verification (VCCV): A Control
Channel for Pseudowires", RFC 5085, DOI 10.17487/RFC5085,
December 2007, <http://www.rfc-editor.org/info/rfc5085>.
[RFC5881] Katz, D. and D. Ward, "Bidirectional Forwarding Detection
(BFD) for IPv4 and IPv6 (Single Hop)", RFC 5881,
DOI 10.17487/RFC5881, June 2010,
<http://www.rfc-editor.org/info/rfc5881>.
[RFC5883] Katz, D. and D. Ward, "Bidirectional Forwarding Detection
(BFD) for Multihop Paths", RFC 5883, DOI 10.17487/RFC5883,
June 2010, <http://www.rfc-editor.org/info/rfc5883>.
[RFC5885] Nadeau, T., Ed. and C. Pignataro, Ed., "Bidirectional
Forwarding Detection (BFD) for the Pseudowire Virtual
Circuit Connectivity Verification (VCCV)", RFC 5885,
DOI 10.17487/RFC5885, June 2010,
<http://www.rfc-editor.org/info/rfc5885>.
[RFC6437] Amante, S., Carpenter, B., Jiang, S., and J. Rajahalme,
"IPv6 Flow Label Specification", RFC 6437,
DOI 10.17487/RFC6437, November 2011,
<http://www.rfc-editor.org/info/rfc6437>.
[Y.1731] ITU-T, "Operation, administration and maintenance (OAM)
functions and mechanisms for Ethernet-based networks",
Recommendation ITU-T G.8013/Y.1731, August 2015.Acknowledgements 🫶
the authors wanna give a huge shoutout to Carlos Pignataro, Stewart Bryant, Karsten Thomann, Qi Sun, and Ian Farrer 💖 they gave super insightful suggestions and reviewed the whole thing, and honestly, iconic behaviour 👑
Contributors 💜
these people helped write it too, so they get their flowers 🌷
Peter Weinberger
Cisco Systems
Email: peweinbe@cisco.com
Michael Lipman
Cisco Systems
Email: mlipman@cisco.com
Mark Townsley
Cisco Systems
Email: townsley@cisco.comAuthors' Addresses 🎀
and here are the authors, the main girlies who made this happen ✨
Maciek Konstantynowicz (editor)
Cisco Systems
Email: maciek@cisco.com
Giles Heron (editor)
Cisco Systems
Email: giheron@cisco.com
Rainer Schatzmayr
Deutsche Telekom AG
Email: rainer.schatzmayr@telekom.de
Wim Henderickx
Alcatel-Lucent, Inc.
Email: wim.henderickx@alcatel-lucent.com📦 where this page comes from
- ietf: rfc8159 2017-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms