| Internet Engineering Task Force | M.M. Mawatari |
| Internet-Draft | Japan Internet Exchange Co.,Ltd. |
| Intended status: Best Current Practice | M.K. Kawashima |
| Expires: December 01, 2012 | NEC AccessTechnica, Ltd. |
| C.B. Byrne | |
| T-Mobile USA | |
| June 2012 |
464XLAT: Combination of Stateful and Stateless Translation
draft-ietf-v6ops-464xlat-04
This document describes an architecture (464XLAT) for providing limited IPv4 connectivity across an IPv6-only network by combining existing and well-known stateful protocol translation RFC 6146 in the core and stateless protocol translation RFC 6145 at the edge. 464XLAT is a simple and scalable technique to quickly deploy limited IPv4 access service to IPv6-only edge networks without encapsulation.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on December 01, 2012.
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
The IANA unallocated IPv4 address pool was exhausted on February 3, 2011. Each RIR's unallocated IPv4 address pool will exhaust in the near future. It will be difficult for many networks to assign IPv4 addresses to end users, despite substantial IP connectivity growth required for fast growing edge networks.
This document describes an IPv4 over IPv6 solution as one of the techniques for IPv4 service extension and encouragement of IPv6 deployment. 464XLAT is not a one for one replacement of full IPv4 functionality. The 464XLAT architecture only supports IPv4 in the client server model, where the server has global IPv4 address. This means it is not fit for IPv4 peer-to-peer communication or inbound IPv4 connections. 464XLAT builds on IPv6 transport and includes full any to any IPv6 communication.
The 464XLAT architecture described in this document uses IPv4/IPv6 translation standardized in [RFC6145] and [RFC6146]. It does not require DNS64 [RFC6147] since an IPv4 host may simply send IPv4 packets, including packets to an IPv4 DNS server, which will be translated on the CLAT to IPv6 and back to IPv4 on the PLAT. 464XLAT networks may use DNS64 [RFC6147] to enable single stateful translation [RFC6146] instead of 464XLAT double translation where possible. The 464XLAT architecture encourages IPv6 transition by making IPv4 services reachable across IPv6-only networks and providing IPv6 and IPv4 connectivity to single-stack IPv4 or IPv6 servers and peers.
By combining 464XLAT with BIH [RFC6535], it is also possible to provide single IPv4 to IPv6 translation service, which will be needed in the future case of IPv6-only servers and peers to be reached from legacy IPv4-only hosts across IPv6-only networks.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
464XLAT architecture is shown in the following figure.
The private IPv4 host on this diagram can reach global IPv4 hosts via translation on both CLAT and PLAT. On the other hand, the IPv6 host can reach other IPv6 hosts on the Internet directly without translation. This means that the CPE can not only have the function of CLAT but also the function of IPv6 native router for IPv6 native traffic.
----
| v6 |
----
|
---- | .---+---. .------.
| v6 |-----+ / \ / \
---- | ------ / IPv6 \ ------ / IPv4 \
+---| CLAT |---+ Internet +---| PLAT |---+ Internet |
------- | ------ \ / ------ \ /
|v4p/v6 |--+ `---------' `----+----'
------- | |
----- | -----
| v4p |----+ | v4g |
----- | -----
<- v4p -> XLAT <--------- v6 --------> XLAT <- v4g ->
v6 : Global IPv6
v4p : Private IPv4
v4g : Global IPv4
The CLAT function on the UE provides an [RFC1918] address and IPv4 default route. The applications on the UE can use the private IPv4 address for reaching global IPv4 hosts via translation on both CLAT and PLAT. On the other hand, reaching IPv6 hosts (including host presented via DNS64 [RFC6147]) does not require the CLAT function on the UE.
----
| v6 |
----
|
.---+---.
/ \
/ IPv6 \
| Internet |
\ /
UE / Mobile Phone `---------'
+----------------------+ |
| ---- | | .---+---. .------.
| | v6 |----+ | / \ / \
| ---- | ------| / IPv6 PDP \ ------ / IPv4 \
| +---| CLAT |---+ Mobile Core +---| PLAT |--+ Internet |
| | ------| \ GGSN / ------ \ /
| | | \ ' `----+---'
| ------ | | `-------' |
| | v4p |---+ | -----
| ------ | | | v4g |
+----------------------+ -----
<- v4p -> XLAT <--------- v6 --------> XLAT <- v4g ->
v6 : Global IPv6
v4p : Private IPv4
v4g : Global IPv4
When an ISP has IPv6 464XLAT, the ISP can provide outgoing IPv4 service to end users across an IPv6 access network. The result is that edge network growth is no longer tightly coupled to the availability of scarce IPv4 addresses.
If the IXP or another provider operates the PLAT, the edge ISP is only required to deploy an IPv6 access network. All ISPs do not need IPv4 access networks. They can migrate their access network to a simple and highly scalable IPv6-only environment.
Incidentally, the effectiveness of 464XLAT was confirmed in the WIDE camp Spring 2012. The result is described in [I-D.hazeyama-widecamp-ipv6-only-experience].
464XLAT in combination with stateful translation [RFC6146] and DNS64 [RFC6147] allows 85% of the Android applications to continue to work with single translation or native IPv6 access. For the remaining 15% of applications that require IPv4 connectivity, the CLAT function on the UE provides a private IPv4 address and IPv4 default-route on the host for the applications to reference and bind to. Connections sourced from the IPv4 interface are immediately routed to the CLAT function and passed to the IPv6-only mobile network, destine to the PLAT. In summary, the UE has the CLAT function that does a stateless translation [RFC6145], but only when required. The mobile network has a PLAT that does stateful translation [RFC6146].
IPv6 address format in 464XLAT is defined in Section 2.2 of [RFC6052].
This case should be used when a prefix delegation mechanism such as DHCPv6-PD [RFC3633] is available to assign a dedicated translation prefix to the CLAT.
Source IPv4 address
+----------------------------+
| Global IPv4 address |
| assigned to IPv4 pool@PLAT |
+--------+ +----------------------------+
| IPv4 | Destination IPv4 address
| server | +----------------------------+
+--------+ | Global IPv4 address |
^ | assigned to IPv4 server |
| +----------------------------+
+--------+
| PLAT | Stateful XLATE(IPv4:IPv6=1:n)
+--------+
^
|
Source IPv6 address (IPv6 cloud)
+--------------------------------------------------------------+
| IPv4-Embedded IPv6 address |
| defined in Section 2.2 of RFC6052 |
+--------------------------------------------------------------+
Destination IPv6 address
+--------------------------------------------------------------+
| IPv4-Embedded IPv6 address |
| defined in Section 2.2 of RFC6052 |
+--------------------------------------------------------------+
(IPv6 cloud)
^
|
+--------+
| | In the case CLAT has a
| | dedicated IPv6 prefix for
| CLAT | translation, the CLAT behaves
| | with only Stateless XLATE
| | (IPv4:IPv6=1:1).
+--------+
^ Source IPv4 address
| +----------------------------+
+--------+ | Private IPv4 address |
| IPv4 | | assigned to IPv4 client |
| client | +----------------------------+
+--------+ Destination IPv4 address
+----------------------------+
| Global IPv4 address |
| assigned to IPv4 server |
+----------------------------+
This case should be used when a prefix delegation mechanism is not available to assign a dedicated translation prefix to the CLAT. In this case, NAT44 SHOULD be used so that all IPv4 source addresses are mapped to a single IPv6 address.
Source IPv4 address
+----------------------------+
| Global IPv4 address |
| assigned to IPv4 pool@PLAT |
+--------+ +----------------------------+
| IPv4 | Destination IPv4 address
| server | +----------------------------+
+--------+ | Global IPv4 address |
^ | assigned to IPv4 server |
| +----------------------------+
+--------+
| PLAT | Stateful XLATE(IPv4:IPv6=1:n)
+--------+
^
|
Source IPv6 address (IPv6 cloud)
+--------------------------------------------------------------+
| IPv4-Embedded IPv6 address |
| defined in Section 2.2 of RFC6052 |
+--------------------------------------------------------------+
Destination IPv6 address
+--------------------------------------------------------------+
| IPv4-Embedded IPv6 address |
| defined in Section 2.2 of RFC6052 |
+--------------------------------------------------------------+
(IPv6 cloud)
^
|
+--------+
| | In the case CLAT does not have
| | a dedicated IPv6 prefix for
| CLAT | translation, the CLAT behaves
| | with NAT44 and Stateless XLATE
| | (IPv4:IPv6=1:1).
+--------+
^ Source IPv4 address
| +----------------------------+
+--------+ | Private IPv4 address |
| IPv4 | | assigned to IPv4 client |
| client | +----------------------------+
+--------+ Destination IPv4 address
+----------------------------+
| Global IPv4 address |
| assigned to IPv4 server |
+----------------------------+
From the delegated DHCPv6 [RFC3633] prefix, a /64 is dedicated to source and receive IPv6 packets associated with the stateless translation [RFC6145].
The CLAT MAY discover the Pref64::/n of the PLAT via some method such as DHCPv6 option, TR-069, DNS APL RR [RFC3123] or [I-D.ietf-behave-nat64-discovery-heuristic].
In the case that DHCPv6-PD [RFC3633] is not available, the CLAT does not have dedicated IPv6 prefix for translation. If the CLAT does not have a dedicated IPv6 prefix for translation, the CLAT performs with NAT44 and stateless translation [RFC6145].
Incoming source IPv4 packets from the LAN of [RFC1918] addresses are NAT44 to the CLAT IPv4 host address. Then, the CLAT will do a stateless translation [RFC6145] so that the IPv4 packets from the CLAT IPv4 host address are translated to the CLAT WAN IPv6 address as described in [RFC6052].
Its subnet prefix is made of the delegated prefix, completed if needed to a /64 by a subnet ID = 0. Its interface ID is the 464XLAT interface ID (Section 10).
The CLAT MAY discover the Pref64::/n of the PLAT via some method such as TR-069, DNS APL RR [RFC3123] or [I-D.ietf-behave-nat64-discovery-heuristic].
+--------+-------------+-----------------------+-------------+
| Server | Application | Traffic Treatment | Location of |
| | and Host | | Translation |
+--------+-------------+-----------------------+-------------+
| IPv6 | IPv6 | End-to-end IPv6 | None |
+--------+-------------+-----------------------+-------------+
| IPv4 | IPv6 | Stateful Translation | PLAT |
+--------+-------------+-----------------------+-------------+
| IPv4 | IPv4 | 464XLAT | PLAT/CLAT |
+--------+-------------+-----------------------+-------------+
| IPv6 | IPv4 | Stateless Translation | CLAT |
+--------+-------------+-----------------------+-------------+
The above chart shows most common traffic types and traffic treatment.
The CLAT SHOULD implement a DNS proxy as defined in [RFC5625]. The case of an IPv4-only node behind CLAT querying an IPv4 DNS server is undesirable since it requires both stateful and stateless translation for each DNS lookup. The CLAT SHOULD set itself as the DNS server via DHCP or other means and proxy DNS queries for IPv4 and IPv6 clients. Using the CLAT enabled home router or UE as a DNS proxy is a normal consume gateway function and simplifies the traffic flow so that only IPv6 native queries are made across the access network. The CLAT SHOULD allow for a client to query any DNS server of its choice and bypass the proxy.
The CLAT is a stateless translation feature which can be implemented in a common home router or mobile phone that has a mobile router feature. The router with CLAT function SHOULD provide common router services such as DHCP of [RFC1918] addresses, DHCPv6, and DNS service. The router SHOULD set itself as the DNS server advertised via DHCP or other means to the clients so that it may implement the DNS proxy function to avoid double translation of DNS request.
While CLAT to CLAT IPv4 communication may work when the client IPv4 subnets do not overlap, this traffic flow is out of scope. 464XLAT is a hub and spoke architecture focused on enabling IPv4-only services over IPv6-only access networks.
Even if the Internet access provider for consumers is different from the PLAT provider (e.g. another internet access provider), it can implement traffic engineering independently from the PLAT provider. Detailed reasons are below:
This 464XLAT architecture has two capabilities. One is a IPv4 -> IPv6 -> IPv4 translation for sharing global IPv4 addresses, another, if combined with BIH [RFC6535], is a IPv4 -> IPv6 translation for reaching IPv6-only servers from IPv4-only clients that can not support IPv6. IPv4-only clients must be support through the long period of global transition to IPv6.
To implement a PLAT, see security considerations presented in Section 5 of [RFC6146].
To implement a CLAT, see security considerations presented in Section 7 of [RFC6145]. The CLAT MAY comply with [RFC6092].
IANA is requested to reserve a Modified EUI-64 identifier for 464XLAT according to section 2.2.2 of [RFC5342]. Its suggested value is 02-00-5E-00-00-00-00-00 to 02-00-5E-0F-FF-FF-FF-FF or 02-00-5E-10-00-00-00-00 to 02-00-5E-EF-FF-FF-FF-FF, depending on whether it should be taken in reserved or available values.
The authors would like to thank JPIX NOC members, JPIX 464XLAT trial service members, Seiichi Kawamura, Dan Drown, Brian Carpenter, Rajiv Asati, Washam Fan, Behcet Sarikaya, Jan Zorz, Tatsuya Oishi, Lorenzo Colitti, Erik Kline, Ole Troan, Maoke Chen, and Gang Chen for their helpful comments. Special acknowledgments go to Remi Despres for his plentiful supports and suggestions, especially about using NAT44 with IANA's EUI-64 ID. We also would like to thank Fred Baker and Joel Jaeggli for their support.
| [RFC2119] | Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. |
| [RFC6052] | Bao, C., Huitema, C., Bagnulo, M., Boucadair, M. and X. Li, "IPv6 Addressing of IPv4/IPv6 Translators", RFC 6052, October 2010. |
| [RFC6144] | Baker, F., Li, X., Bao, C. and K. Yin, "Framework for IPv4/IPv6 Translation", RFC 6144, April 2011. |
| [RFC6145] | Li, X., Bao, C. and F. Baker, "IP/ICMP Translation Algorithm", RFC 6145, April 2011. |
| [RFC6146] | Bagnulo, M., Matthews, P. and I. van Beijnum, "Stateful NAT64: Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers", RFC 6146, April 2011. |
The following are examples of IPv4/IPv6 Address Translation on the 464XLAT architecture.
Example 1. (Case of enabling only stateless XLATE on CLAT)
In the case that IPv6 prefix greater than /64 is assigned to end users by such as DHCPv6-PD [RFC3633], only the function of Stateless XLATE should be enabled on CLAT. Because the CLAT can use dedicated a /64 from the assigned IPv6 prefix for Stateless XLATE.
Host & configuration value
+------------------------------+
| IPv4 server |
| [198.51.100.1] | IP packet header
+------------------------------+ +--------------------------------+
^ | Source IP address |
| | [192.0.2.1] |
| | Destination IP address |
| | [198.51.100.1] |
+------------------------------+ +--------------------------------+
| PLAT | ^
| IPv4 pool address | |
| [192.0.2.1 - 192.0.2.100] | |
| PLAT-side XLATE IPv6 prefix | |
| [2001:db8:1234::/96] | |
+------------------------------+ +--------------------------------+
^ | Source IP address |
| | [2001:db8:aaaa::192.168.1.2] |
| | Destination IP address |
| | [2001:db8:1234::198.51.100.1] |
+------------------------------+ +--------------------------------+
| CLAT | ^
| PLAT-side XLATE IPv6 prefix | |
| [2001:db8:1234::/96] | |
| CLAT-side XLATE IPv6 prefix | |
| [2001:db8:aaaa::/96] | |
+------------------------------+ +--------------------------------+
^ | Source IP address |
| | [192.168.1.2] |
| | Destination IP address |
| | [198.51.100.1] |
+------------------------------+ +--------------------------------+
| IPv4 client |
| [192.168.1.2/24] |
+------------------------------+
Delegated IPv6 prefix for client: 2001:db8:aaaa::/56
Example 2. (Case of enabling NAT44 and stateless XLATE on CLAT)
In the case that IPv6 prefix /64 is assigned to end users, the function of NAT44 and Stateless XLATE should be enabled on CLAT. Because the CLAT does not have dedicated IPv6 prefix for translation.
Host & configuration value
+-------------------------------+
| IPv4 server |
| [198.51.100.1] | IP packet header
+-------------------------------+ +-------------------------------+
^ | Source IP address |
| | [192.0.2.1] |
| | Destination IP address |
| | [198.51.100.1] |
+-------------------------------+ +-------------------------------+
| PLAT | ^
| IPv4 pool address | |
| [192.0.2.1 - 192.0.2.100] | |
| PLAT-side XLATE IPv6 prefix | |
| [2001:db8:1234::/96] | |
+-------------------------------+ +-------------------------------+
^ | Source IP address |
| | [2001:db8:aaaa:200:5e10:0:0] |
| | Destination IP address |
| | [2001:db8:1234::198.51.100.1] |
| +-------------------------------+
+-------------------------------+ ^
| CLAT Stateless XLATE function | |
| - - - - - - - - - - - - - - - | |
| PLAT-side XLATE IPv6 prefix | |
| [2001:db8:1234::/96] | |
| CLAT-side XLATE IPv6 prefix | |
| [2001:db8:aaaa::/64] | |
| CLAT-side XLATE IPv6 EUI-64 ID| |
| [02-00-5E-10-00-00-00-00] | |
+ - - - - - - - - - - - - - - - + +-------------------------------+
| ^ | | Source IP address |
| | | | [10.255.255.1] |
| | | | Destination IP address |
| | | | [198.51.100.1] |
+ - - - - - - - - - - - - - - - + +-------------------------------+
| CLAT NAT44 function | ^
| - - - - - - - - - - - - - - - | |
| NAT44 NATed address | |
| [10.255.255.1/32] | |
+-------------------------------+ |
^ +-------------------------------+
| | Source IP address |
| | [192.168.1.2] |
| | Destination IP address |
| | [198.51.100.1] |
+-------------------------------+ +-------------------------------+
| IPv4 client |
| [192.168.1.2/24] |
+-------------------------------+
Delegated IPv6 prefix for client: 2001:db8:aaaa::/64