RFC 8983

Internet Key Exchange Protocol Version 2 (IKEv2) Notification Status Types for IPv4/IPv6 Coexistence

📅 published February 2021, from ietf

RFC 8983: Internet Key Exchange Protocol Version 2 (IKEv2) Notification Status Types for IPv4/IPv6 Coexistence ✨

RFC number: 8983
Authors: M. Boucadair (Orange)
Organisation: Internet Engineering Task Force (IETF)
Category: Standards Track
ISSN: 2070-1721
Date: February 2021
Updates: 7296

okay bestie, this one is a Standards Track doc from M. Boucadair at Orange 🧚 it's dated February 2021 and it updates RFC 7296 (the big IKEv2 spec) 💅 so if you're into IKEv2 you need to know about this one fr

Abstract

okay so the abstract is giving main character energy 💖 it adds new IKEv2 notification status types so the responder can tell the initiator which address families are allowed 🌈 the whole point is better IPv4 and IPv6 coexistence 🦋

this doc also updates RFC 7296 🫶

Status of This Memo

this is an Internet Standards Track doc 🎀 it's a product of the IETF and it represents the consensus of the IETF community 🫶 it got public review and was approved for publication by the Internet Engineering Steering Group (IESG) ✨ if you want more on Internet Standards, check Section 2 of RFC 7841 🍓

info about the current status, any errata, and how to give feedback lives at https://www.rfc-editor.org/info/rfc8983 🌸

Copyright Notice

copyright (c) 2021 IETF Trust and the persons identified as the document authors, all rights reserved 💜 this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as in effect on the date of publication 📜 please actually read those, bestie, because they spell out your rights and restrictions 😭

code components pulled out of this doc must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions 🔥 and they come without warranty, as described in the Simplified BSD License 💀

1. Introduction
2. Terminology
3. Why Not INTERNAL_ADDRESS_FAILURE?
4. IP6_ALLOWED and IP4_ALLOWED Status Types
5. Update to RFC 7296
6. Security Considerations
7. IANA Considerations
8. References
- 8.1. Normative References
- 8.2. Informative References
Acknowledgements
Author's Address

1. Introduction 🦋

okay so this part is pure drama 😭 per [RFC7849], if the subscription data or network config only allows one IP address family (IPv4 or IPv6), the cellular host must not request a second PDP-Context (Section 3.2 of [RFC6459]) to the same Access Point Name (APN) for the other address family (AF) 🙈 the 3GPP network tells the cellular host which PDP types are allowed through Session Management (SM) cause codes ✨ the main ones are:

cause #50 "PDP type IPv4 only allowed": the network uses this to say only PDP type IPv4 is allowed for the requested Public Data Network (PDN) connectivity 💖
cause #51 "PDP type IPv6 only allowed": the network uses this to say only PDP type IPv6 is allowed for the requested PDN connectivity 🌈
cause #52 "single address bearers only allowed": the network uses this to say the requested PDN connectivity is accepted, but only single IP version bearers are allowed 🎀

so if the requested IPv4v6 PDP-Context isn't supported by the network but IPv4 and IPv6 PDP types are both allowed, the cellular host gets configured with an IPv4 address or an IPv6 prefix 🧚 it then has to start another PDP-Context activation for the other address family, on top of the one already active for that APN 😤 the whole reason for a second PDP-Context is to get dual-stack connectivity (IPv4 and IPv6 both working) through two PDP-Contexts 👑

when the User Equipment (UE) attaches to the 3GPP network over a non-3GPP access network (like Wireless Local Area Network (WLAN)), there are no equivalent IKEv2 [RFC7296] notification codes for the 3GPP network to tell the UE why an IP address family isn't assigned, or whether the UE should retry with another address family 😭 that's a real gap

this doc fills that void by introducing new IKEv2 notification status types for the sake of deterministic UE behaviors (Section 4) 🫶

these notification status types aren't specific to 3GPP architectures, so they can be used in other deployment contexts too 🌸 cellular networks are just given as an illustration example 🍓

2. Terminology ✨

okay bestie, the key words are the capitalised ones, and they're the only ones that count 🔥 the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they show up in all capitals, just like this 💅

this doc uses terms defined in [RFC7296] 📚 so you should know the "initiator" and "responder" terms from that doc 🧚

3. Why Not INTERNAL_ADDRESS_FAILURE? 🙈

these address assignment failures can happen when an initiator asks for IP addresses or prefixes:

An initiator asks for IPvx, but IPvx address assignment is not supported by the responder.
An initiator requests both IPv4 and IPv6 addresses, but only IPv4 address assignment is supported by the responder.
An initiator requests both IPv4 and IPv6 addresses, but only IPv6 prefix assignment is supported by the responder.
An initiator asks for both IPv4 and IPv6 addresses, but only one address family can be assigned by the responder for policy reasons.

so Section 3.15.4 of [RFC7296] defines a generic notification error type, INTERNAL_ADDRESS_FAILURE, for when handling an address assignment request fails 😬 the responder only sends INTERNAL_ADDRESS_FAILURE if no addresses can be assigned at all 💀 that behavior doesn't let the initiator figure out why a given address family wasn't assigned, or whether it should try a different one 😭

honestly INTERNAL_ADDRESS_FAILURE is a catch-all for any address-related issue an IKEv2 responder runs into 🗑️ and it just doesn't give the initiator enough hints to change its behavior 🙃

4. IP6_ALLOWED and IP4_ALLOWED Status Types 💜

the IP6_ALLOWED and IP4_ALLOWED notification status types (see Section 7) exist so the initiator knows what the responder supports for address family assignment 🎀 they also tell the initiator why an address assignment failed 🧚 the initiator then uses them to adjust its behavior (Section 5) 🫶

no data is attached to these notifications 🌈

5. Update to RFC 7296 🔥

okay this is the actual update part, so pay attention bestie 😤

if the initiator is dual stack (meaning it supports both IPv4 and IPv6), it MUST include configuration attributes for both address families in its configuration request (unless explicit policy or configuration says otherwise) 💅 more details about IPv4 and IPv6 configuration attributes are in Section 3.15 of [RFC7296] ✨ these attributes are used to infer the requested or assigned AFs listed in Table 1 📊

the responder MUST include the IP6_ALLOWED and/or IP4_ALLOWED notification status type in its response to an address assignment request, as Table 1 shows 🦋

  +=============+==============+=============+=====================+
  | Requested   | Supported    | Assigned    | Returned            |
  | AF(s)       | AF(s)        | AF(s)       | Notification Status |
  | (Initiator) | (Responder)  | (Responder) | Type(s) (Responder) |
  +=============+==============+=============+=====================+
  | IPv4        | IPv6         | None        | IP6_ALLOWED         |
  +-------------+--------------+-------------+---------------------+
  | IPv4        | IPv4         | IPv4        | IP4_ALLOWED         |
  +-------------+--------------+-------------+---------------------+
  | IPv4        | IPv4 and     | IPv4        | IP4_ALLOWED,        |
  |             | IPv6         |             | IP6_ALLOWED         |
  +-------------+--------------+-------------+---------------------+
  | IPv6        | IPv6         | IPv6        | IP6_ALLOWED         |
  +-------------+--------------+-------------+---------------------+
  | IPv6        | IPv4         | None        | IP4_ALLOWED         |
  +-------------+--------------+-------------+---------------------+
  | IPv6        | IPv4 and     | IPv6        | IP4_ALLOWED,        |
  |             | IPv6         |             | IP6_ALLOWED         |
  +-------------+--------------+-------------+---------------------+
  | IPv4 and    | IPv4         | IPv4        | IP4_ALLOWED         |
  | IPv6        |              |             |                     |
  +-------------+--------------+-------------+---------------------+
  | IPv4 and    | IPv6         | IPv6        | IP6_ALLOWED         |
  | IPv6        |              |             |                     |
  +-------------+--------------+-------------+---------------------+
  | IPv4 and    | IPv4 and     | IPv4 and    | IP4_ALLOWED,        |
  | IPv6        | IPv6         | IPv6        | IP6_ALLOWED         |
  +-------------+--------------+-------------+---------------------+
  | IPv4 and    | IPv4 or IPv6 | IPv4 or     | IP4_ALLOWED,        |
  | IPv6        | (policy      | IPv6        | IP6_ALLOWED         |
  |             | based)       |             |                     |
  +-------------+--------------+-------------+---------------------+

               Table 1: Returned Notification Status Types

if the initiator only gets one single IP4_ALLOWED or IP6_ALLOWED notification from the responder, the initiator MUST NOT send a follow-up request for an alternate address family the responder doesn't support 🙅‍♀️

if a dual-stack initiator asks only for an IPv6 prefix (or an IPv4 address) but only gets an IP4_ALLOWED (or IP6_ALLOWED) notification status type from the responder, the initiator MUST send a request for IPv4 address(es) (or IPv6 prefix(es)) 🔥

if a dual-stack initiator asks for both an IPv6 prefix and an IPv4 address, but only gets an IPv6 prefix (or an IPv4 address) along with both IP4_ALLOWED and IP6_ALLOWED notification status types, the initiator MAY send a request for the other AF (i.e., an IPv4 address or IPv6 prefix) 🌈 in that case the initiator MUST create a new IKE Security Association (SA) and request the other address family using the new IKE SA 🧚

for any other address-related error cases that aren't covered by those notification status types, the responder/initiator MUST follow the procedure defined in Section 3.15.4 of [RFC7296] 🫶

6. Security Considerations 💀

okay security time, bestie 🙈 since a node's IPv4/IPv6 capabilities are readily determined from the traffic it generates, this document doesn't introduce any new security considerations compared to the ones in [RFC7296] 🔒 those still apply, no cap 💅

7. IANA Considerations 💅✨

okay so IANA just updated the "IKEv2 Notify Message Types - Status Types" registry (you can find it at https://www.iana.org/assignments/ikev2-parameters/) with two new status types, and they're absolutely iconic 🎀:

+=======+================================+===========+
| Value | NOTIFY MESSAGES - STATUS TYPES | Reference |
+=======+================================+===========+
| 16439 | IP4_ALLOWED                    | RFC 8983  |
+-------+--------------------------------+-----------+
| 16440 | IP6_ALLOWED                    | RFC 8983  |
+-------+--------------------------------+-----------+

  Table 2: Updates to "IKEv2 Notify Message Types -
                Status Types" Registry

8. References 📚🦋

8.1. Normative References 💜

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC7296]  Kaufman, C., Hoffman, P., Nir, Y., Eronen, P., and T.
           Kivinen, "Internet Key Exchange Protocol Version 2
           (IKEv2)", STD 79, RFC 7296, DOI 10.17487/RFC7296, October
           2014, <https://www.rfc-editor.org/info/rfc7296>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

8.2. Informative References 🧚

[RFC6459]  Korhonen, J., Ed., Soininen, J., Patil, B., Savolainen,
           T., Bajko, G., and K. Iisakkila, "IPv6 in 3rd Generation
           Partnership Project (3GPP) Evolved Packet System (EPS)",
           RFC 6459, DOI 10.17487/RFC6459, January 2012,
           <https://www.rfc-editor.org/info/rfc6459>.

[RFC7849]  Binet, D., Boucadair, M., Vizdal, A., Chen, G., Heatley,
           N., Chandler, R., Michaud, D., Lopez, D., and W. Haeffner,
           "An IPv6 Profile for 3GPP Mobile Devices", RFC 7849,
           DOI 10.17487/RFC7849, May 2016,
           <https://www.rfc-editor.org/info/rfc7849>.

Acknowledgements 🫶

Many thanks to Christian Jacquenet for the review 💖

Thanks to Paul Wouters, Yaov Nir, Valery Smyslov, Daniel Migault, Tero Kivinen, and Michael Richardson for the comments and review 🌸

Thanks to Benjamin Kaduk for the AD review ✨

Thanks to Murray Kucherawy, Éric Vyncke, and Robert Wilton for the IESG review 👑

Author's Address 🍓

Mohamed Boucadair
Orange
35000 Rennes
France

Email: mohamed.boucadair@orange.com

📦 where this page comes from

ietf: rfc8983 2021-02
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms