One document matched: draft-ietf-softwire-dslite-radius-ext-02.xml
<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!ENTITY rfc2119 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY rfc2865 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2865.xml">
<!ENTITY __reference.RFC.2869__g60i1uxb SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2869.xml">
]>
<?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?>
<?rfc toc="yes"?>
<?rfc compact="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes" ?>
<?rfc strict="yes" ?>
<?rfc linkmailto="yes" ?>
<rfc category="std" docName="draft-ietf-softwire-dslite-radius-ext-02"
ipr="pre5378Trust200902">
<front>
<title abbrev="DS-Lite RADIUS Extensions">RADIUS Extensions for Dual-Stack
Lite</title>
<author fullname="Roberta Maglione" initials="R." surname="Maglione">
<organization abbrev="">Telecom Italia</organization>
<address>
<postal>
<street>Via Reiss Romoli 274</street>
<city>Torino</city>
<code>10148</code>
<country>Italy</country>
</postal>
<phone></phone>
<email>roberta.maglione@telecomitalia.it</email>
</address>
</author>
<author fullname="Alain Durand" initials="A." surname="Durand">
<organization>Juniper Networks</organization>
<address>
<postal>
<street>1194 North Mathilda Avenue</street>
<city>Sunnyvale</city>
<region>CA</region>
<code>94089-1206</code>
<country>USA</country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email>adurand@juniper.net</email>
<uri></uri>
</address>
</author>
<date month="March" year="2011" />
<area>Internet</area>
<workgroup>softwire</workgroup>
<abstract>
<t>Dual-Stack Lite is a solution to offer both IPv4 and IPv6
connectivity to customers which are addressed only with an IPv6 prefix.
DS-Lite requires to pre-configure the AFTR tunnel information on the B4
element. In many networks, the customer profile information may be
stored in AAA servers while client configurations are mainly provided
through DHC protocol. This document specifies one new RADIUS attribute
to carry Dual-Stack Lite Address Family Transition Router (AFTR) name;
the RADIUS attribute is defined based on the equivalent DHCPv6 option
already specified in draft-ietf-softwire-ds-lite-tunnel-option. This
RADIUS attribute is meant to be used between the RADIUS Server and the
NAS, it is not intended to be used directly between the B4 element and
the RADIUS Server.</t>
</abstract>
</front>
<middle>
<section anchor="intro" title="Introduction">
<t>Dual-Stack Lite <xref
target="I-D.ietf-softwire-dual-stack-lite"></xref> is a solution to
offer both IPv4 and IPv6 connectivity to customers which are addressed
only with an IPv6 prefix (no IPv4 address is assigned to the attachment
device). One of its key components is an IPv4-over-IPv6 tunnel, but a
DS-Lite Basic Bridging BroadBand (B4) will not know if the network it is
attached to offers Dual-Stack Lite support, and if it did, would not
know the remote end of the tunnel to establish a connection.</t>
<t>To inform the B4 of the AFTR's location, a Fully Qualified Domain
Name (FQDN) may be used. Once this information is conveyed, the presence
of the configuration indicating the AFTR's location also informs a host
to initiate Dual-Stack Lite (DS-Lite) service and become a Softwire
Initiator.</t>
<t>The draft draft-ietf-softwire-ds-lite-tunnel-option <xref
target="I-D.ietf-softwire-ds-lite-tunnel-option"></xref> specifies a
DHCPv6 option which is meant to be used by a Dual-Stack Lite client
(Basic Bridging BroadBand element, B4) to discover its Address Family
Transition Router (AFTR) name. In order to be able to populate such
option the DHCPv6 Server must be pre-provisioned with the Address Family
Transition Router (AFTR) name.</t>
<t>In Broadband environments, customer profile may be managed by AAA
servers, together with user Authentication, Authorization, and
Accounting (AAA). RADIUS protocol <xref target="RFC2865"></xref> is
usually used by AAA Servers to communicate with network elements. <xref
target="I-D.ietf-radext-ipv6-access"></xref> describes a typical
broadband network scenario in which the Network Access Server (NAS) acts
as the access gateway for the users (hosts or CPEs) and the NAS embeds a
DHCPv6 Server function that allows it to locally handle any DHCPv6
requests issued by the clients.</t>
<t>Since the DS-Lite AFTR information can be stored in AAA servers and
the client configuration is mainly provided through DHC protocol running
between the NAS and the requesting clients, a new RADIUS attribute is
needed to send AFTR information from AAA server to the NAS.</t>
<t>This document aims at defining a new RADIUS attribute to be used for
carrying the DS-Lite Tunnel Name, based on the equivalent DHCPv6 option
already specified in <xref
target="I-D.ietf-softwire-ds-lite-tunnel-option"></xref></t>
</section>
<!-- intro -->
<section anchor="term" title="Terminology">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <xref
target="RFC2119"></xref>.</t>
<t>The terms DS-Lite Basic Bridging BroadBand element (B4) and the
DS-Lite Address Family Transition Router element (AFTR) are defined in
<xref target="I-D.ietf-softwire-dual-stack-lite"></xref></t>
</section>
<section title="DS-Lite Configuration with RADIUS and DHCPv6">
<t>The <xref target="fig1"></xref> illustrates how the RADIUS protocol
and DHCPv6 work together to accomplish DS-Lite configuration on the B4
element when a PPP Session is used to provide connectivity to the
user.</t>
<t>The Network Access Server (NAS) operates as a client of RADIUS and as
DHCP Server for DHC protocol. The NAS initially sends a RADIUS Access
Request message to the RADIUS server, requesting authentication. Once
the RADIUS server receives the request, it validates the sending client
and if the request is approved, the AAA server replies with an Access
Accept message including a list of attribute-value pairs that describe
the parameters to be used for this session. This list may also contain
the AFTR Tunnel Name. When the NAS receives a DHCPv6 client request
containing the DS-Lite tunnel Option, the NAS shall use the address
returned in the RADIUS DS-Lite-Tunnel-Addr attribute to populate the
DHCPv6 OPTION_DS_LITE_ADDR option in the DHCPv6 reply message.</t>
<t><figure anchor="fig1" height=""
title="RADIUS and DHCPv6 Message Flow for a PPP Session">
<artwork><![CDATA[ B4 NAS AAA
| | Server
| | |
|----PPP LCP Config Request------> | |
| | |
| |----Access-Request ---->|
| | |
| |<---- Access-Accept-----|
| | (DS-Lite-Tunnel-Name) |
|<-----PPP LCP Config ACK ----- | |
| | |
| | |
|------ PPP IPv6CP Config Req ---->| |
| | |
|<----- PPP IPv6CP Config ACK -----| |
| | |
|------- DHCPv6 Solicit -------->| |
| | |
|<-------DHCPv6 Advertisement -----| |
| (DHCPv6 OPTION_DS_LITE_NAME) | |
| | |
|------- DHCPv6 Request -------->| |
| | |
|<-------- DHCPv6 Reply --------- | |
| (DHCPv6 OPTION_DS_LITE_NAME) | |
DHCPv6 RADIUS
]]></artwork>
</figure></t>
<t>The <xref target="fig2"></xref> illustrates how the RADIUS protocol
and DHCPv6 work together to accomplish DS-Lite configuration on the B4
element when an IP Session is used to provide connectivity to the
user.</t>
<t>The only difference between this message flow and previous one is
that in this scenario the interaction between NAS and AAA/ RADIUS Server
is triggered by the DHCPv6 Solicit message received by the NAS from the
B4 acting as DHCPv6 client, while in case of a PPP Session the trigger
is the PPP LCP Config Request message received by the NAS.</t>
<figure anchor="fig2" height=""
title="RADIUS and DHCPv6 Message Flow for an IP Session">
<artwork><![CDATA[ B4 NAS AAA
| | Server
|------ DHCPv6 Solicit ---------> | |
| | |
| |----Access-Request ---->|
| | |
| |<-Access-Accept---------|
| | (DS-Lite-Tunnel-Name) |
| | |
|<-------DHCPv6 Advertisement------| |
| (DHCPv6 OPTION_DS_LITE_NAME) | |
| | |
|------- DHCPv6 Request -------->| |
| | |
| | |
| <---- DHCPv6 Reply ---- | |
| (DHCPv6 OPTION_DS_LITE_NAME) | |
DHCPv6 RADIUS
]]></artwork>
</figure>
</section>
<!-- term -->
<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -->
<section anchor="Attrib" title="RADIUS Attribute">
<t>This section specifies the format of the new RADIUS attribute.</t>
<section anchor="DSLITE-Name" title=" DS-Lite-Tunnel-Name ">
<t>Description</t>
<t>The DS-Lite-Tunnel-Name RADIUS attribute contains a Fully Qualified
Domain Name that refers to the AFTR the client is requested to
establish a connection with. The NAS shall use the name returned in
the RADIUS DS-Lite-Tunnel-Name attribute to populate the DHCPv6
OPTION_DS_LITE_NAME option <xref
target="I-D.ietf-softwire-ds-lite-tunnel-option"></xref></t>
<t>This attribute MAY be used in Access-Accept packets and it MAY be
present in Accounting-Request records where the Acct-Status-Type is
set to Start, Stop or Interim-Update. The DS-Lite-Tunnel-Name RADIUS
attribute and MUST NOT appear more than once in a message.</t>
<t>A summary of the DS-Lite-Tunnel-Name RADIUS attribute format is
shown below. The fields are transmitted from left to right.</t>
<figure>
<preamble></preamble>
<artwork><![CDATA[ 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | DS-Lite-Tunnel-Name (FQDN) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| DS-Lite-Tunnel-Name (FQDN) (cont) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork>
<postamble></postamble>
</figure>
<t>Type:</t>
<t><list counter="1" hangIndent="5">
<t>TBA1 for DS-Lite-Tunnel-Name.</t>
</list>Length: <list counter="1" hangIndent="5">
<t>This field indicates the total length in octets of this
attribute including the Type, the Length fields and the length in
octets of the DS-Lite-Tunnel-Name field</t>
</list></t>
<t>DS-Lite-Tunnel-Name:<list counter="1" hangIndent="5">
<t>A single Fully Qualified Domain Name of the remote tunnel
endpoint, located at the DS-Lite AFTR.</t>
</list></t>
<t></t>
<!-- ProvSnd -->
<!-- ProvRecv -->
</section>
</section>
<section title="Table of attributes">
<t>The following table provides a guide to which attributes may be found
in which kinds of packets, and in what quantity.</t>
<texttable style="none">
<ttcol>Request</ttcol>
<ttcol>Accept</ttcol>
<ttcol>Reject</ttcol>
<ttcol>Challenge</ttcol>
<ttcol>Accounting Request</ttcol>
<ttcol>#</ttcol>
<ttcol>Attribute</ttcol>
<c>0-1</c>
<c>0-1</c>
<c>0</c>
<c>0</c>
<c>0-1</c>
<c>TBA1</c>
<c>DS-Lite-Tunnel-Name</c>
</texttable>
<t>The following table defines the meaning of the above table
entries.</t>
<t></t>
<texttable style="none" suppress-title="true">
<ttcol></ttcol>
<ttcol></ttcol>
<c>0</c>
<c>This attribute MUST NOT be present in packet.</c>
<c>0+</c>
<c>Zero or more instances of this attribute MAY be present in
packet.</c>
<c>0-1</c>
<c>Zero or one instance of this attribute MAY be present in
packet.</c>
</texttable>
</section>
<section anchor="seccons" title="Security Considerations">
<t>This document has no additional security considerations beyond those
already identified in <xref target="RFC2865"></xref></t>
<t><xref target="I-D.ietf-softwire-dual-stack-lite"></xref> discusses
DS-Lite related security issues.</t>
</section>
<section anchor="IANA" title="IANA Considerations">
<t>This document requests the allocation of a new Radius attribute types
from the IANA registry "Radius Attribute Types" located at
http://www.iana.org/assignments/radius-types</t>
<t><list>
<t>DS-Lite-Tunnel-Name - TBA1</t>
</list></t>
</section>
</middle>
<back>
<references title="Normative References">
&rfc2119;
<?rfc include='reference.I-D.ietf-softwire-dual-stack-lite'?>
<?rfc include='reference.I-D.ietf-softwire-ds-lite-tunnel-option'?>
<?rfc include='reference.I-D.ietf-radext-ipv6-access'?>
&rfc2865;
<?rfc ?>
</references>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-24 04:36:36 |