One document matched: draft-ietf-softwire-dslite-radius-ext-06.xml
<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!ENTITY rfc2119 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY rfc2865 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2865.xml">
<!ENTITY __reference.RFC.2869__g60i1uxb SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2869.xml">
]>
<?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?>
<?rfc toc="yes"?>
<?rfc compact="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes" ?>
<?rfc strict="yes" ?>
<?rfc linkmailto="yes" ?>
<rfc category="std" docName="draft-ietf-softwire-dslite-radius-ext-06"
ipr="pre5378Trust200902">
<front>
<title abbrev="DS-Lite RADIUS Extensions">RADIUS Extensions for Dual-Stack
Lite</title>
<author fullname="Roberta Maglione" initials="R." surname="Maglione">
<organization abbrev="">Telecom Italia</organization>
<address>
<postal>
<street>Via Reiss Romoli 274</street>
<city>Torino</city>
<code>10148</code>
<country>Italy</country>
</postal>
<phone></phone>
<email>roberta.maglione@telecomitalia.it</email>
</address>
</author>
<author fullname="Alain Durand" initials="A." surname="Durand">
<organization>Juniper Networks</organization>
<address>
<postal>
<street>1194 North Mathilda Avenue</street>
<city>Sunnyvale</city>
<region>CA</region>
<code>94089-1206</code>
<country>USA</country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email>adurand@juniper.net</email>
<uri></uri>
</address>
</author>
<date month="August" year="2011" />
<area>Internet</area>
<workgroup>softwire</workgroup>
<abstract>
<t>Dual-Stack Lite is a solution to offer both IPv4 and IPv6
connectivity to customers which are addressed only with an IPv6 prefix.
Dual-Stack Lite requires to pre-configure the Dual-Stack Lite Address
Family Transition Router (AFTR) tunnel information on the Basic Bridging
BroadBand (B4) element. In many networks, the customer profile
information may be stored in Authentication Authorization and Accounting
(AAA) servers while client configurations are mainly provided through
Dynamic Host Configuration Protocol (DHCP). This document specifies a
new Remote Authentication Dial In User Service (RADIUS) attribute to
carry Dual-Stack Lite Address Family Transition Router Tunnel name; the
RADIUS attribute is defined based on the equivalent DHCPv6
OPTION_AFTR_NAME option. This RADIUS attribute is meant to be used
between the RADIUS Server and the Network Access Server (NAS), it is not
intended to be used directly between the Basic Bridging BroadBand
element and the RADIUS Server.</t>
</abstract>
</front>
<middle>
<section anchor="intro" title="Introduction">
<t>Dual-Stack Lite <xref target="RFC6333"></xref> is a solution to offer
both IPv4 and IPv6 connectivity to customers which are addressed only
with an IPv6 prefix (no IPv4 address is assigned to the attachment
device). One of its key components is an IPv4-over-IPv6 tunnel, but a
Dual-Stack-Lite Basic Bridging BroadBand (B4) will not know if the
network it is attached to offers Dual-Stack Lite support, and if it did,
would not know the remote end of the tunnel to establish a
connection.</t>
<t>To inform the Basic Bridging BroadBand (B4) of the Address Family
Transition Router's (AFTR) location, a Fully Qualified Domain Name
(FQDN) may be used. Once this information is conveyed, the presence of
the configuration indicating the AFTR's location also informs a host to
initiate Dual-Stack Lite (DS-Lite) service and become a Softwire
Initiator.</t>
<t><xref target="RFC6334"></xref> specifies a DHCPv6 option which is
meant to be used by a Dual-Stack Lite client (Basic Bridging BroadBand
element, B4) to discover its Address Family Transition Router (AFTR)
name. In order to be able to populate such option the DHCPv6 Server must
be pre-provisioned with the Address Family Transition Router (AFTR)
name.</t>
<t>In Broadband environments, customer profile may be managed by AAA
servers, together with user Authentication, Authorization, and
Accounting (AAA). Remote Authentication Dial In User Service (RADIUS)
protocol <xref target="RFC2865"></xref> is usually used by AAA Servers
to communicate with network elements. <xref
target="I-D.ietf-radext-ipv6-access"></xref> describes a typical
broadband network scenario in which the Network Access Server (NAS) acts
as the access gateway for the users (hosts or CPEs) and the NAS embeds a
DHCPv6 Server function that allows it to locally handle any DHCPv6
requests issued by the clients.</t>
<t>Since the DS-Lite AFTR information can be stored in AAA servers and
the client configuration is mainly provided through Dynamic Host
Configuration Protocol (DHCP) running between the NAS and the requesting
clients, a new RADIUS attribute is needed to send AFTR information from
AAA server to the NAS.</t>
<t>This document aims at defining a new RADIUS attribute to be used for
carrying the DS-Lite Tunnel Name, based on the equivalent DHCPv6 option
already specified in <xref target="RFC6334"></xref></t>
</section>
<!-- intro -->
<section anchor="term" title="Terminology">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <xref
target="RFC2119"></xref>.</t>
<t>The terms DS-Lite Basic Bridging BroadBand element (B4) and the
DS-Lite Address Family Transition Router element (AFTR) are defined in
<xref target="RFC6333"></xref></t>
</section>
<section title="DS-Lite Configuration with RADIUS and DHCPv6">
<t>The <xref target="fig1"></xref> illustrates how the RADIUS protocol
and DHCPv6 work together to accomplish DS-Lite configuration on the B4
element when a PPP Session is used to provide connectivity to the
user.</t>
<t>The Network Access Server (NAS) operates as a client of RADIUS and as
DHCP Server for DHC protocol. The NAS initially sends a RADIUS Access
Request message to the RADIUS server, requesting authentication. Once
the RADIUS server receives the request, it validates the sending client
and if the request is approved, the AAA server replies with an Access
Accept message including a list of attribute-value pairs that describe
the parameters to be used for this session. This list MAY also contain
the AFTR Tunnel Name. When the NAS receives a DHCPv6 client request
containing the DS-Lite tunnel Option, the NAS SHALL use the name
returned in the RADIUS DS-Lite-Tunnel-Name attribute to populate the
DHCPv6 OPTION_AFTR_NAME option in the DHCPv6 reply message.</t>
<t><figure anchor="fig1" height=""
title="RADIUS and DHCPv6 Message Flow for a PPP Session">
<artwork><![CDATA[ B4 NAS AAA
| | Server
| | |
|----PPP LCP Config Request------> | |
| | |
| |----Access-Request ---->|
| | |
| |<---- Access-Accept-----|
| | (DS-Lite-Tunnel-Name) |
|<-----PPP LCP Config ACK ------- | |
| | |
| | |
|------ PPP IPv6CP Config Req ---->| |
| | |
|<----- PPP IPv6CP Config ACK -----| |
| | |
|------- DHCPv6 Solicit -------->| |
| | |
|<-------DHCPv6 Advertisement -----| |
| (DHCPv6 OPTION_AFTR_NAME) | |
| | |
|------- DHCPv6 Request -------->| |
| | |
|<-------- DHCPv6 Reply ---------- | |
| (DHCPv6 OPTION_AFTR_NAME) | |
DHCPv6 RADIUS
]]></artwork>
</figure></t>
<t>The <xref target="fig2"></xref> illustrates how the RADIUS protocol
and DHCPv6 work together to accomplish DS-Lite configuration on the B4
element when an IP Session is used to provide connectivity to the
user.</t>
<t>The only difference between this message flow and previous one is
that in this scenario the interaction between NAS and AAA/ RADIUS Server
is triggered by the DHCPv6 Solicit message received by the NAS from the
B4 acting as DHCPv6 client, while in case of a PPP Session the trigger
is the PPP LCP Config Request message received by the NAS.</t>
<figure anchor="fig2" height=""
title="RADIUS and DHCPv6 Message Flow for an IP Session">
<artwork><![CDATA[ B4 NAS AAA
| | Server
|------ DHCPv6 Solicit ---------> | |
| | |
| |----Access-Request ---->|
| | |
| |<---Access-Accept-------|
| | (DS-Lite-Tunnel-Name) |
| | |
|<-------DHCPv6 Advertisement------| |
| (DHCPv6 OPTION_AFTR_NAME) | |
| | |
|------- DHCPv6 Request -------->| |
| | |
| | |
|<----- DHCPv6 Reply ------------- | |
| (DHCPv6 OPTION_AFTR_NAME) | |
DHCPv6 RADIUS
]]></artwork>
</figure>
<t></t>
<t>In the scenario depicted in <xref target="fig2"></xref> the
Access-Request packet contains a Service-Type attribute with the value
Authorize Only (17), thus according to <xref target="RFC5080"></xref>
the Access-Request packet MUST contain a State attribute.</t>
<t>After receiving the DS-Lite-Tunnel-Name in the initial Access-Accept
the NAS MUST store the received AFTR Tunnel Name locally. When the B4
sends a DHCPv6 Renew message to request an extension of the lifetimes
for the assigned address or prefix, the NAS does not have to initiate a
new Access-Request towards the AAA server to request the AFTR tunnel
name. The NAS retrieves the previously stored AFTR tunnel name and uses
it in its reply.</t>
<t>According to <xref target="RFC3315"></xref> if the DHCPv6 server to
which the DHCPv6 Renew message was sent at time T1 has not responded,
the DHCPv6 client initiates a Rebind/Reply message exchange with any
available server. In this scenario the NAS receiving the DHCPv6 rebind
message MUST initiate a new Access-Request towards the AAA server. The
NAS MAY include the DS-Lite-Tunnel-Name attribute in its
Access-Request.</t>
<t>If the NAS does not receive the DS-Lite-Tunnel-Name attribute in the
Access-Accept it MAY fallback to a pre-configured default tunnel name,
if any. If the NAS does not have any pre-configured default tunnel name
or if the NAS receives an Access-Reject, the IPv4 over IPv6 tunnel
cannot be established, thus the B4 element has only IPv6 connectivity.
</t>
</section>
<!-- term -->
<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -->
<section anchor="Attrib" title="RADIUS Attribute">
<t>This section specifies the format of the new RADIUS attribute.</t>
<section anchor="DSLITE-Name" title=" DS-Lite-Tunnel-Name ">
<t>Description</t>
<t>The DS-Lite-Tunnel-Name RADIUS attribute contains a Fully Qualified
Domain Name that refers to the AFTR the client is requested to
establish a connection with. The NAS SHALL use the name returned in
the RADIUS DS-Lite-Tunnel-Name attribute to populate the DHCPv6
OPTION_AFTR_NAME option <xref target="RFC6334"></xref></t>
<t>This attribute MAY be used in Access-Request packets as a hint to
the RADIUS server; for example if the NAS is pre-configured with a
default tunnel name, this name MAY be inserted in the attribute. The
RADIUS server MAY ignore the hint sent by the NAS and it MAY assign a
different AFTR tunnel name.</t>
<t>If the NAS includes the DS-Lite-Tunnel-Name attribute, but the AAA
server does not recognize it, this attribute MUST be ignored by the
AAA Server.</t>
<t>If the NAS does not receive DS-Lite-Tunnel-Name attribute in the
Access-Accept it MAY fallback to a pre-configured default tunnel name,
if any. If the NAS does not have any pre-configured default tunnel
name, the tunnel can not be established.</t>
<t>If the NAS is pre-provisioned with a default AFTR tunnel name and
the AFTR tunnel name received in Access-Accept is different from the
configured default, then the AFTR tunnel name received in the
Access-Accept message MUST be used for the session.</t>
<t>If the NAS cannot support the received AFTR tunnel name for any
reason, the tunnel SHOULD NOT be established.</t>
<t>When the Access-Request is triggered by a DHCPv6 Rebind message if
the AFTR tunnel name received in the Access-Accept is different from
the currently used one for that session, the NAS MUST force the B4 to
re-establish the tunnel using the new AFTR name received in the
Access-Accept message.</t>
<t>If an implementation includes the Change-of-Authorization (CoA)
messages <xref target="RFC5176"></xref>, they could be used to modify
the current established DS-Lite tunnel. When the NAS receives a CoA
Request message containing the DS-Lite-Tunnel-Name attribute, the NAS
MUST send a Reconfigure message to a B4 to inform the B4 that the NAS
has new or updated configuration parameters and that the B4 is to
initiate a Renew/Reply or Information-request/Reply transaction with
the NAS in order to receive the updated information.</t>
<t>Upon receiving an AFTR tunnel name different from the currently
used one, the B4 MUST terminate the current DS-Lite tunnel and the B4
MUST establish a new DS-LITE tunnel with the specified AFTR.</t>
<t>The DS-Lite-Tunnel-Name RADIUS attribute MAY be present in
Accounting-Request records where the Acct-Status-Type is set to Start,
Stop or Interim-Update. The DS-Lite-Tunnel-Name RADIUS attribute MUST
NOT appear more than once in a message.</t>
<t>A summary of the DS-Lite-Tunnel-Name RADIUS attribute format is
shown below. The fields are transmitted from left to right.</t>
<figure>
<preamble></preamble>
<artwork><![CDATA[ 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | DS-Lite-Tunnel-Name(FQDN)...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork>
<postamble></postamble>
</figure>
<t>Type:</t>
<t><list counter="1" hangIndent="5">
<t>TBA1 for DS-Lite-Tunnel-Name.</t>
</list>Length: <list counter="1" hangIndent="5">
<t>This field indicates the total length in octets of this
attribute including the Type, the Length fields and the length in
octets of the DS-Lite-Tunnel-Name field</t>
</list></t>
<t>DS-Lite-Tunnel-Name:<list counter="1" hangIndent="5">
<t>A single Fully Qualified Domain Name of the remote tunnel
endpoint, located at the DS-Lite AFTR.</t>
</list></t>
<t>As the DS-Lite-Tunnel-Name attribute is used to populate the DHCPv6
OPTION_AFTR_NAME option, the DS-Lite-Tunnel-Name field is formatted as
required in DHCPv6 (Section 8 of <xref target="RFC3315"></xref>
"Representation and Use of Domain Names"). Briefly, the format
described is using a single octet noting the length of one DNS label
(limited to at most 63 octets), followed by the label contents. This
repeats until all labels in the FQDN are exhausted, including a
terminating zero-length label. Any updates to Section 8 of <xref
target="RFC3315"></xref> also apply to encoding of this field.</t>
<t>The data type of DS-Lite-Tunnel-Name RADIUS attribute is a string
with opaque encapsulation, according to <xref target="RFC2865">section
5 of </xref></t>
<!-- ProvSnd -->
<!-- ProvRecv -->
</section>
</section>
<section title="Table of attributes">
<t>The following tables provide a guide to which attributes may be found
in which kinds of packets, and in what quantity.</t>
<texttable style="none">
<ttcol>Access- Request</ttcol>
<ttcol>Access- Accept</ttcol>
<ttcol>Access- Reject</ttcol>
<ttcol>Challenge</ttcol>
<ttcol>Accounting Request</ttcol>
<ttcol>#</ttcol>
<ttcol>Attribute</ttcol>
<c>0-1</c>
<c>0-1</c>
<c>0</c>
<c>0</c>
<c>0-1</c>
<c>TBA1</c>
<c>DS-Lite-Tunnel-Name</c>
</texttable>
<texttable align="left" style="none">
<ttcol>CoA-Request</ttcol>
<ttcol>CoA-ACK</ttcol>
<ttcol>CoA-NACK</ttcol>
<ttcol>#</ttcol>
<ttcol>Attribute</ttcol>
<c>0-1</c>
<c>0</c>
<c>0</c>
<c>TBA1</c>
<c>DS-Lite-Tunnel-Name</c>
</texttable>
<t>The following table defines the meaning of the above table
entries.</t>
<texttable style="none" suppress-title="true">
<ttcol></ttcol>
<ttcol></ttcol>
<c>0</c>
<c>This attribute MUST NOT be present in packet.</c>
<c>0+</c>
<c>Zero or more instances of this attribute MAY be present in
packet.</c>
<c>0-1</c>
<c>Zero or one instance of this attribute MAY be present in
packet.</c>
</texttable>
<t></t>
</section>
<section anchor="seccons" title="Security Considerations">
<t>This document has no additional security considerations beyond those
already identified in <xref target="RFC2865"></xref></t>
<t><xref target="RFC6333"></xref> discusses Dual-Stack Lite related
security issues.</t>
</section>
<section anchor="IANA" title="IANA Considerations">
<t>This document requests the allocation of a new Radius attribute types
from the IANA registry "Radius Attribute Types" located at
http://www.iana.org/assignments/radius-types</t>
<t><list>
<t>DS-Lite-Tunnel-Name - TBA1</t>
</list></t>
</section>
</middle>
<back>
<references title="Normative References">
&rfc2119;
<?rfc include='reference.RFC.6333'?>
<?rfc include='reference.RFC.6334'?>
&rfc2865;
<?rfc include='reference.RFC.3315'
?>
<?rfc include='reference.RFC.5080'?>
<?rfc ?>
<?rfc ?>
</references>
<references title="Informative References">
<?rfc include='reference.I-D.ietf-radext-ipv6-access'
?>
<?rfc include='reference.RFC.5176'?>
</references>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-23 14:22:48 |