One document matched: draft-ietf-softwire-problem-statement-01.txt
Differences from draft-ietf-softwire-problem-statement-00.txt
Network Working Group X. Li
Internet-Draft CERNET
Expires: September 1, 2006 A. Durand
Comcast
D. Ward
Cisco Systems, Inc
S. Dawkins, Ed.
Futurewei
February 28, 2006
Softwire Problem Statement
draft-ietf-softwire-problem-statement-01.txt
Status of this Memo
By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on September 1, 2006.
Copyright Notice
Copyright (C) The Internet Society (2006).
Abstract
The Softwires Working Group is specifying the standardization of
discovery, control and encapsulation methods for connecting IPv4
networks across IPv6-only networks and IPv6 networks across IPv4-only
Li, et al. Expires September 1, 2006 [Page 1]
Internet-Draft Softwire Problem Statement February 2006
networks in a way that will encourage multiple, inter-operable vendor
implementations. At the highest level, the Softwires Working Group
is tasked to identify, and extend where necessary, standard protocols
to support a selected set of "IPv4/IPv6" and "IPv6/IPv4" transition
problems. This document describes the specific problems ("Hubs and
Spokes" and "Mesh") that will be solved as part of a solution phase
following the completion of this document, within a relatively tight
"time-to-market" as requested by operators at IETF 63. Some
individual requirements (and non-requirements) are also identified in
this document at times in order to better describe the specific scope
for a given problem definition.
Li, et al. Expires September 1, 2006 [Page 2]
Internet-Draft Softwire Problem Statement February 2006
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 5
2. Hubs and Spokes Problem . . . . . . . . . . . . . . . . . . . 7
2.1. Description . . . . . . . . . . . . . . . . . . . . . . . 9
2.2. Non-upgradable CPE router . . . . . . . . . . . . . . . . 10
2.3. Network Address Translation (NAT) and Port Address
Translation (PAT) . . . . . . . . . . . . . . . . . . . . 11
2.4. Static Prefix Delegation . . . . . . . . . . . . . . . . . 11
2.5. Softwire Initiator . . . . . . . . . . . . . . . . . . . . 12
2.6. Softwire Concentrator . . . . . . . . . . . . . . . . . . 12
2.7. Softwire Concentrator Discovery . . . . . . . . . . . . . 13
2.8. Scaling . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.9. Routing . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.10. Multicast . . . . . . . . . . . . . . . . . . . . . . . . 13
2.11. Security . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.11.1. Authentication, Authorization and Accounting . . . . 13
2.11.2. Privacy, Integrity, and Replay protection . . . . . . 14
2.12. Operations and Management (OAM) . . . . . . . . . . . . . 14
2.13. Encapsulations . . . . . . . . . . . . . . . . . . . . . . 14
3. Mesh Problem . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.1. Mesh Description . . . . . . . . . . . . . . . . . . . . . 16
3.2. Scaling . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.3. Persistence, Discovery and Setup Time . . . . . . . . . . 18
3.4. Address Family/SAF Reachability . . . . . . . . . . . . . 18
3.5. Softwire Encapsulation . . . . . . . . . . . . . . . . . . 18
3.6. Security . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.7. Operations and Management . . . . . . . . . . . . . . . . 19
3.8. Address Family Encapsulations . . . . . . . . . . . . . . 20
4. Security Considerations . . . . . . . . . . . . . . . . . . . 21
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22
6. Changes from -00 . . . . . . . . . . . . . . . . . . . . . . . 23
7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 24
7.1. Authors . . . . . . . . . . . . . . . . . . . . . . . . . 24
7.2. Contributors . . . . . . . . . . . . . . . . . . . . . . . 24
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 25
8.1. Normative References . . . . . . . . . . . . . . . . . . . 25
8.2. Informative References . . . . . . . . . . . . . . . . . . 25
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 27
Intellectual Property and Copyright Statements . . . . . . . . . . 28
Li, et al. Expires September 1, 2006 [Page 3]
Internet-Draft Softwire Problem Statement February 2006
1. Introduction
The Softwires Working Group is specifying the standardization of
discovery, control and encapsulation methods for connecting IPv4
networks across IPv6-only networks and IPv6 networks across IPv4-only
networks in a way that will encourage multiple, inter-operable vendor
implementations. This document is describing the scenarios that the
Working Group is going to focus on leading toward defining solutions.
A few generic assumptions are listed up front:
o Local Area Networks will often support both protocol families in
order to accommodate both IPv4-only and IPv6-only applications.
Global reachability requires the establishment of softwire
connectivity to transit across portions of the network that do not
support both address families. Wide area networks that support
one or both address families may be separated by transit networks
that do not support all address families. Softwire connectivity
is necessary to establish global reachability of both address
families.
o Softwires are to be used in IP/MPLS based networks to forward both
unicast and multicast traffic.
o Softwires are assumed to be non-ephemeral in nature.
o Although Softwires are long-lived, the setup time of a softwire is
expected to be a very small fraction of the total time required
for startup of the Customer Premise Equipment (CPE)/Address Family
Boundary Router (AFBR).
o The nodes that actually initiate softwires should support dual-
stack (IPv4 and IPv6) functionality.
o The goal of this effort is to reuse or extending existing
technology. The 'time-to-market' requirement for solutions to the
stated problems is very strict and existing, deployed technology
must be very strongly considered in our solution selection.
The history of IPv4 and IPv6 transition strategies at the IETF is a
very long and complex. Here we list out some steps we have taken to
further the effort and it has lead to the creation of this document
and a few 'working rules' for us to accomplish our work:
o At the IETF 63 "LightWeight Reachability softWires" (LRW) BOF
meeting, attendees from several operators requested a very tight
timeframe for delivery of a solution, based on time-to-market
considerations. This problem statement is narrowly scoped to
accommodate near-term deployment.
Li, et al. Expires September 1, 2006 [Page 4]
Internet-Draft Softwire Problem Statement February 2006
o At the Paris Softwires interim meeting in October, 2005,
participants divided the overall problem space into two separate
"sub-problems" to solve based on network topology. These two
problems are referred to as "Hubs and Spokes" (described in
section 3) and "Mesh" (described in Section 4).
As stated, there are two scenarios that emerged when discussing the
traversal of networks composed of differing address families. The
scenarios are quite common in today's network deployments. The
primary difference between "Spokes and Hubs" and "Mesh" is how many
connections and associated routes are managed by each IPv4 or IPv6
"island". "Hubs and Spokes" is characterized with one connection and
associated static default route, and "Mesh" is characterized by
multiple connections and routing prefixes. In general, the two can
be categorized as host or LAN connectivity and network (or VPN)
connectivity problems. Looking at the history of multi-address
family networking, the clear delineation of the two scenarios was
never clearly illustrated but they are now the network norm, and both
must be solved. Later during the solution phase of the WG, these
problems will be treated as related, but separate, problem spaces.
Similar protocols and mechanisms will be used when possible, but
different protocols and mechanisms may be selected when necessary to
meet the requirements of each given problem space.
1.1. Terminology
Address Family (AF) - IPv4 or IPv6. Presently defined values for
this field are specified in RFC 1700 (see the Address Family Numbers
section).
Address Family Border Router (AFBR) - The router that interconnects
two networks that use different address families.
Customer Premise Equipment (CPE) - Under the scope of this document,
this refers to terminal and associated equipment and inside wiring
located at a subscriber's premises and connected with a carrier's
communication channel(s) at the demarcation point (" demarc "). The
demarc is a point established in a building or complex to separate
customer equipment from telephone, cable or other service provider
equipment. CPE can be a host or router, depending on the specific
characteristics of the access network. The demarc point for IPv4 may
or may not be the same as the demarc point for IPv6, thus there can
be one CPE box acting for IPv4 and IPv6 or two separate ones, one for
IPv4 and one for IPv6.
Home gateway - Existing piece of equipment that connects the home
network to the provider network. Usually act as CPE for one or both
address familly.
Li, et al. Expires September 1, 2006 [Page 5]
Internet-Draft Softwire Problem Statement February 2006
Softwire (SW) - A "tunnel" that is created on the basis of a control
protocol setup between softwire endpoints with shared point-to-point
or multipoint-to-point state. Softwires are generally dynamic in
nature (they may be initiated and terminated on demand), but may be
very long-lived.
Softwire Concentrator (SC) - The node terminating the softwire in the
service provider network.
Softwire Initiator (SI) - The node initiating the softwire within the
customer network.
Softwire Transport Header AF (STH AF) - the address family of the
outermost IP header of a softwire.
Softwire Payload Header AF (SPH AF) - the address family of the IP
headers being carried within a softwire. Note that additional
"levels" of IP headers may be present if (for example) a tunnel is
carried over a softwire - the key attribute of SPH AF is that it is
directly encapsulated within the softwire and the softwire endpoint
will base forwarding decisions on the SPH AF when a packet is exiting
the softwire.
Subsequent Address Family (SAF) - Additional information about the
type of the additional information about the type of the Network
Layer Reachability Information (e.g. unicast or multicast).
Li, et al. Expires September 1, 2006 [Page 6]
Internet-Draft Softwire Problem Statement February 2006
2. Hubs and Spokes Problem
The "Hubs and Spokes" problem is named in reference to the airline
industry where major companies have establised a relatively small
number of well connected hubs and then serve smaller airports from
those hubs. There are four variant cases of the Hubs and Spokes
problem which are shown in Reference Diagram 1.
Reference Diagram 1
Case 1: IPv6 connectivity across an IPv4-only access network (STH).
Softwire initiator is the host CPE (directly connected to a modem),
which is dual-stack. There is no other gateway device. The IPv4
traffic should not traverse the softwire.
+-------+ +------------+ +--------+
| | |Softwire | | IPv6 |
+---------+ | IPv4 |--|concentrator|--| Network|=>Internet
|v4/v6 |--| | +------------+ +--------+
|Host CPE | | |
+---------+ |Network|
+-------+
_ _ _ _ _ _ __
()_ _ _ _ _ _ __() IPv6 SPH
"softwire"
|--------------||-------------------------|
IPv4-only IPv6 or dual-stack
Li, et al. Expires September 1, 2006 [Page 7]
Internet-Draft Softwire Problem Statement February 2006
Case 2: IPv6 connectivity across an IPv4-only access network (STH).
Softwire initiator is the router CPE, which is a dual-stack device.
The IPv4 traffic should not traverse the softwire
+-------+ +-------------+ +--------+
| | | Softwire | | v6 |
+-----+ +------+ | v4 |--| concentrator|--| Network|=>Internet
|v4/v6|--|v4/v6 |--| | +-------------+ +--------+
|Host | |Router| |Network|
+-----+ |v4/v6 | | |
| CPE | +-------+
+------+
_ _ _ _ _ _ __
()_ _ _ _ _ _ __() IPv6 SPH
"softwire"
|--------------||--------------||-------------------------|
Dual-stack IPv4-only IPv6 or dual-stack
Case 3: IPv6 connectivity across an IPv4-only access network (STH).
The CPE is IPv4-only. Softwire initiator is a host, which act
as an IPv6 host CPE. The IPv4 traffic should not traverse the
softwire.
+-------+ +-------------+ +--------+
| | | Softwire | | v6 |
+------+ +------+ | v4 |--| concentrator|--| Network|=>Internet
|v4/v6 |--|v4 |--| | +-------------+ +--------+
|Host | |Router| |Network|
|v6 CPE| |v4 CPE| | |
+------+ | | +-------+
+------+
_ _ _ _ _ _ _ _ _ _ _ _
()_ _ _ _ _ _ _ _ _ _ _ _() IPv6 SPH
"softwire"
|-----------------------||-------------------------|
IPv4 only IPv6 or dual stack
Li, et al. Expires September 1, 2006 [Page 8]
Internet-Draft Softwire Problem Statement February 2006
Case 4: IPv6 connectivity across an IPv4-only access network (STH).
The routing CPE is IPv4-only. Softwire initiator is a device acting
as an IPv6 CPE router inside the home network. The IPv4 traffic
should not traverse the softwire.
+-----+
|v4/v6| +-------+ +------------+ +-------+
|Host | | | |Softwire | | v6 |
+-----+ +------+ | v4 |--|concentrator|--|Network|=>Internet
| |v4 |--| | +------------+ +-------+
|---------|Router| |Network|
| |v4 CPE| +-------+
+---------+ +------+
|Softwire |
|Initiator|
|v6 Router|
| CPE |
+---------+
_ _ _ _ _ _ _ _ _ _ _ _
()_ _ _ _ _ _ _ _ _ _ _ _() IPv6 SPH
"softwire"
|--------||-----------------------||----------------------|
Dual IPv4 only IPv6 or dual stack
stack
The converse cases exist, replacing IPv4 by IPv6 and vice versa
in the above figures.
Figure 1
2.1. Description
In this scenario, carriers (or large enterprise networks acting as
carriers for their internal networks) have an infrastructure which in
at least one device on any given path (core, access, home gateway)
supports only one address family, with customers who wish to support
applications bound to an address family that cannot be routed end-to-
end. The address family that must be "crossed" is called the
Softwire Transport Header, or STH AF (which could be either IPv4 or
IPv6).
In order to support applications bound to another address family (the
Softwire Payload Header Address Family, or SPH AF), it is necessary
to establish a virtual dual-stack infrastructure (end-to-end),
Li, et al. Expires September 1, 2006 [Page 9]
Internet-Draft Softwire Problem Statement February 2006
typically by means of automatically-established tunnels (Softwires).
The traffic that can traverse the network via its native AF must not
be forced to take the softwire path. Only the traffic that otherwise
would not be able to be forwarded due to the AF mismatch should be
forwarded within the softwire. The goal is to avoid overwhelming the
softwire concentrator (SC).
A network operator may choose to enable a single address family in
one or several parts of this infrastructure for policy reasons (i.e.,
traffic on the network is dominant in one of the address families, a
single address family is used to lower OAM cost, etc.) or for
technical reasons (i.e., because one or more devices are not able to
support both address families).
There are several obstacles that may preclude support for both
address families:
a) One or more devices (routers or some other media-specific
aggregation point device) being used across the infrastructure (core,
access) that supports only one address family. Typically the reasons
for this situation include a lack of vendor support for one of the
address families, the (perceived) cost of upgrading them, complexity
of running both address families natively, operation/management
reasons to avoid upgrades (perhaps temporarily), or economic reasons
(such as a commercially insignificant amount of traffic with the non-
supported address family).
b) The home gateway (CPE router or other equipment at the demarc
point), cannot be easily upgraded to support both address families.
Typically the reason for this is the lack of vendor support for one
of the address families, commercial or operational reasons for not
carrying out the upgrade (i.e., operational changes and/or cost may
need to be supported by the carrier for all the customers, which can
turn into millions of units), or customer reluctance to change/
upgrade CPE router (cost, "not broken, so don't change it").
2.2. Non-upgradable CPE router
Residential and small-office CPE equipment may be limited to support
only one address familly. Often, they are owned by a customer or
carrier who is unwilling or unable to upgrade them to run in dual
stack mode (as shown in Case 2 and Case 3).
When the CPE router cannot run in dual stack mode a softwire will
have to be established by a node located behind that CPE router.
This can be accomplished either by a regular host in the home running
softwire software (Case 2) or by a dedicated piece of hardware acting
as the "IPv6 router" (Case 3). Such a device is fairly simple in
Li, et al. Expires September 1, 2006 [Page 10]
Internet-Draft Softwire Problem Statement February 2006
design and only requires one physical network interface. Again, only
the traffic of the mismatched AF will be forwarded via the softwire.
Traffic that can otherwise be forwarded without a softwire should not
be encapsulated.
2.3. Network Address Translation (NAT) and Port Address Translation
(PAT)
A typical case of non-upgradable CPE router is a pre-existing IPv4/
NAT home gateway, so the softwires solution must support NAT
traversal.
If the NAT is not in the home gateway, but in carrier equipment
located at the other end of the access link (typically in an carrier
POP), support for NAT traversal is still required.
Establishing a softwire through NAT or PAT must work by default.
However, there is no requirement for explicitly "autodetect" NAT or
PAT presence during softwire setup - simply enabling NAT traversal
could be sufficient to meet this requirement.
Although the tunneling protocol must be able to traverse NATs,
tunneling protocols may have an optional capability to bypass UDP
encapsulation if not traversing a NAT.
2.4. Static Prefix Delegation
An important characteristic of this problem in IPv4 networks is that
the carrier-facing CPE IP address is typically dynamically assigned.
Also, if the softwire has to be established from a node behind a CPE
router, that node IP address can also be dynamically assigned. In
cases where static IP addresses are unavailable, dynamic addresses
are a problem for some Internet accessible services. Solutions like
external dynamic DNS and dynamic NAT port forwarding have been
deployed, but it would be simpler if, in IPv6 networks, a static
prefix was delegated to the customer, even in the case of single node
network. That prefix would allow for the registration of stable
addresses in the DNS and also enough room to use either RFC3041
privacy extension or cryptographically generated addresses (CGA)
[RFC3972]. The softwire protocol does not need to define a new
method for prefix delegation however DHCPv6 prefix delegation must be
able to run over a softwire. Note also that the IP addresses of the
softwire link itself do not need to be stable, as, even in the single
PC being attached behind it, a /64 prefix will be delegated.
Link local addresses allocated at both ends of the tunnel are enough
for packets forwarding, but for management purpose like traceroute,
global addresses can be allocated using existing protocols such as
Li, et al. Expires September 1, 2006 [Page 11]
Internet-Draft Softwire Problem Statement February 2006
Neighbor Discovery or DHCPv6.
2.5. Softwire Initiator
In the Hubs and Spokes problem, softwires are always initiated by the
customer side. Thus, the node hosting the end of the softwire within
the customer network is called the softwire initiator. It can run on
any dual stack node. As noted earlier, this can be the CPE access
device, another dedicated CPE router behind the original CPE access
device or simply any kind of node (host, appliance, sensor, etc.).
The softwire initiator does not have to be always the same node
and/or always have been delegated the same IP address. In
particular, in the nomadic case (e.g. a user opening up his laptop in
various Wi-Fi hot-spots), the softwire initiator could potentially
obtain an IP address of one address family outside its original
carrier network and still want to obtain the other address family
addresses from its original carrier.
Nomadicity should be supported.
IPv4 provider can also periodically change the IPv4 address allocated
to the gateway. The softwire initiator has to discover in a
reasonable period of time that the tunnel is down and restart tunnel
establishment. This re-establishment should not change the IPv6
prefix and other parameters allocated to the site.
2.6. Softwire Concentrator
On the carrier side, softwires are terminated on a softwire
concentrator. An carrier may deploy several softwire concentrators
(for example one per POP) for scalability reasons. A softwire
concentrator is in practice a dual-stack router connected to the
dual-stack core of the carrier or directly to the upstream providers.
Softwire concentrators are not nomadic and have stable IP addresses.
It may be the case that one of the address families is not natively
supported, even if this is not optimal, in the softwire concentrator,
but instead by means of tunnels to the upstreams (or other networks).
Softwire concentrator functionality will be based on existing
standards for tunneling, prefixes and addresses allocation,
management. The working group must define Best Current Practices for
Softwires Concentrator architecture and interaction between these
protocols and recommend profiles. These recommendations must take
into account the distributed nature of the Softwires Concentrator in
the provider network and the impact on core IPv6 network (for
instance: prefix aggregation).
Li, et al. Expires September 1, 2006 [Page 12]
Internet-Draft Softwire Problem Statement February 2006
2.7. Softwire Concentrator Discovery
The softwire initiator must know the DNS name or IP address of the
softwire concentrator. An automated discovery phase may be used to
return the IP address(s), or name(s) of the concentrator.
Alternatively, this information may be configured by the user, or or
by the provider of the softwire initiator in advance. The details of
this discovery problem are outside the scope of this document,
however previous work could be taken in consideration. Examples
include: [I-D.durand-naptr-service-discovery], [I-D.ietf-v6ops-ipsec-
tunnels], and [I-D.palet-v6ops-solution-tun-auto-disc].
2.8. Scaling
In a hubs and spokes model, a carrier must be able to scale the
solution to millions of softwire initiators by adding more hubs (i.e.
softwire concentrators). DNS redirection and/or local anycast
addresses among other choices, coupled with the (to-be-determined)
softwire concentrator discovery solution will enable sharing the load
among concentrators.
2.9. Routing
As customer networks are typically attached via a single link to
their carrier, the minimum routing requirement is a default route for
each of the address families.
2.10. Multicast
Existing multicast solutions can be used over the softwire.
Typically, such solution would be either proxy Multicast Listener
Discovery or Internet Group Membership Protocol and Protocol-
Independent Multicast.
2.11. Security
2.11.1. Authentication, Authorization and Accounting
The softwire protocol must support customer authentication in the
control plane, in order to authorize access to the service, and
provide adequate logging of activity (accounting). However, an
carrier may decide to turn it off in some circumstances, for
instance, when the customer is already authenticated by some other
means, such as closed networks, cellular networks, etc., in order to
avoid unnecessary overhead.
The protocol should offer mutual authentication in scenarios where
the initiator requires identity proof from the concentrator.
Li, et al. Expires September 1, 2006 [Page 13]
Internet-Draft Softwire Problem Statement February 2006
The softwire solution, at least for "Hubs and Spokes", must be
integrable with commonly deployed AAA solutions (although extensions
to those AAA solutions may be needed).
2.11.2. Privacy, Integrity, and Replay protection
The softwire Control and/or Data plane must be able to provide full
payload security (such as IPsec or SSL) when desired. This
additional protection must be separable from the tunneling aspect of
the softwire mechanism itself. For IPsec, default profiles must be
defined. [draft-ietf-v6ops-ipsec-tunnels] provides guidelines on
this.
2.12. Operations and Management (OAM)
As it is assumed that the softwire may have to go across NAT or PAT,
a keepalive mechanism must be defined. Such a mechanism is also
useful for dead peer detection. However in some circumstances (i.e.,
narrowband access, billing per traffic, etc.) the keepalive mechanism
may consume unnecessary bandwidth, so turning it on or off, and
modifying the periodicity, must be supported administrative options.
Other needed OAM features include:
- Logging
- Usage accounting
- End-point failure detection (the detection mechanism must operate
within the tunnel)
- Path failure detection (the detection mechanism must operate
outside the tunnel)
2.13. Encapsulations
IPv6/IPv4, IPv6/UDP/IPv4 and IPv4/IPv6 are on the critical path for
"Hubs and Spokes" softwires. Other encapsulations, like IPv6/IPv6 or
IPv4/IPv4, are nice to have but not on the critical path. There is
no intention to place limits on additional encapsulations beyond
those explicitly mentioned in this specification.
Li, et al. Expires September 1, 2006 [Page 14]
Internet-Draft Softwire Problem Statement February 2006
3. Mesh Problem
The "Mesh" problem is named in reference to typical routing problems
in which there are more than one paths to a destination and a routing
protocol is needed to select the best path. It is also extremely
similar to the problems that the L3VPN Working Group is tackling in
which reduced, private and/or overlapping virtual routing and
forwarding tables are announced. The key difference is that the
reachability that must be announced across the transit core will
include more than VPN address family routes.
Li, et al. Expires September 1, 2006 [Page 15]
Internet-Draft Softwire Problem Statement February 2006
Reference Diagram 2
+----------+ +----------+
|differing | |differing |
|AF as core| |AF as core|
|access | |access |
|island | |island |
+----------+ +----------+
| |
| |
Dual-Stack Dual-Stack
"AFBR" "AFBR"
| |
| |
+----------------------------+
| |
| |
+-------+ | | +-------+
|same AF| | Single AF only | |same AF|
|as core|-------| transit core |-------|as core|
|access | | | |access |
|network| | | |network|
+-------+ | | +-------+
| |
+----------------------------+
| / \ |
| / \ |
Dual-Stack Dual-Stack
"AFBR" "AFBR"
| | |
| | |
+--------+ +--------+
|dual | |dual |
|stack | |stack |
|access | |access |
|island | |island |
+--------+ +--------+
Figure 2
3.1. Mesh Description
In this problem, carriers (or large enterprise networks acting as
carrier for their internal resources) may be required to establish
connectivity to 'islands' of networks of one address family type
across a transit core of a differing address family type. For an
Li, et al. Expires September 1, 2006 [Page 16]
Internet-Draft Softwire Problem Statement February 2006
example, See Reference Diagram 2. To provide reachability across the
transit core, dual-stack devices are installed that act as "Address
Family Boundary Routers." These AFBRs can be performing peering
across autonomous systems or, performing as Provider Edge routers
(PE) in VPN parlance within an autonomous system. With respect to
deployment considerations, the islands do not have to be upgraded at
the time of deploying the transit core and interwork as if there was
no awareness of the AFBR.
The AFBRs are the only devices in the carrier's network that must be
able to perform dual-stack operations and setup and encapsulate
softwires in a mesh to the other islands. They then pass
reachability information as appropriate according to policy. They
may be multiply connected to the transit network and thus, have to be
able to exchange appropriate information and make a routing selection
choice as to the best exit point. Note that this creates multipoint-
to-point reachability using a point-to-point logical overlay of
softwire connectivity.
It should also be noted that the mesh problem can be considered as a
derivative of L3VPN, where the core provides transit in one address
family and the islands are connected via L3VPN of another address
family. This analogy only holds true if the islands can to be
represented as VPNs. In general, the diagrams frequently used for
L3VPNs is very similar. The key point is that the reachability
information that is to be exchanged must not be limited to VPNs or
any single AF or SAF or combination of AF/SAF. The solution must be
generic enough to carry any AF or SAF.
In the future a tunnel concentrator may be a different device than
the AFBR that is announcing reacability. In that future phase, the
AFBR may need to announce a third party tunnel concentrator.
3.2. Scaling
In the mesh problem, the number of AFBRs is on the order of the
number of islands though it should be clear that a single AFBR could
handle many islands if the islands have distinct routing and
forwarding tables. A primary issue in the Mesh problem is that the
size of the routing tables exchanged between the islands is of the
order of the 'full Internet' (with respect to the island's native
Address Family) plus any VPNs. These tables plus the routing tables
associated with the transit core (and VPNs of the same AF as the
transit core) must be stored on the AFBRs. The number of peering
points of an AFBR will be on the order of the number of Autonomous
System Border Routers (ASBRs), which are assumed to be multiply
peered to the transit core (multi-homed) for reliability. An island
can also have multiple AFBRs for reliability as well. Both the
Li, et al. Expires September 1, 2006 [Page 17]
Internet-Draft Softwire Problem Statement February 2006
island or the transit core may contain route reflectors or
hierarchical routing with impunity.
An AFBR should be able to pass route filters of data or routing
tables it does not wish to receive. Peering AFBRs must adhere to the
route or route table filters and not send reachability information.
Other attributes that can be sent from one AFBR to the other may
include "no export" or similar mechanisms to prevent subsequent
reannouncements of reachability information. The scaling of the
information to be exchanged is on the order of similar data exchanged
for L3VPNs.
3.3. Persistence, Discovery and Setup Time
Discovery of the AFBRs and softwire encapsulation could be
accomplished by the routing protocol during capability advertisement.
An alternative is that the endpoints could be passed in new data
formats or attributes, within a routing protocol.
The duration of the softwire for inter-island reachability is
considered to be as long as the duration of the peering session.
Thus, dynamicity is very low. The setup time should be on the order
of the same duration to setup L3VPNs.
3.4. Address Family/SAF Reachability
It has been reported that the softwires to connect the islands will
need to be able to perform IPv4/IPv6, IPv6/IPv4 and be able to
exchange multicast and VPN routing tables. The islands will need to
be able to perform multicast routing and if the transit core does not
provide native multicast services, the "classic" multicast solutions
can be used over the softwires. If native multicast services are
enabled, further work may need to be accomplished to optimize the
multicast forwarding path, receiver transmission load or receiver
load.
3.5. Softwire Encapsulation
In the strictest sense, the softwire encapsulation has to be dual
stack. There is no requirement that only one encapsulation technique
must be used. It could be possible to have more than one available
at each AFBR. The AFBR must be able to prioritize which
encapsulation technique it will use if there is more than one
available.
The encapsulations used to traverse the transit core must be enabled
to handle a choice of methods. Common choices that should create a
minimal set would include: L2TPv3, IP in IP, MPLS, IPsec, GRE. The
Li, et al. Expires September 1, 2006 [Page 18]
Internet-Draft Softwire Problem Statement February 2006
choice of encapsulation must not be subject to either an island or
peer-wise limitation. Different AF/SAF combinations must be able to
be encapsulated differently according to the requirements of the
network deployment. For example, IPv4 unicast may be encapsulated in
MPLS while IPv4 VPNs may be encapsulated in IPsec or L2TPv3. This
flexibility should not cause multiple peering sessions although it is
not precluded that this may be the desired network deployment. There
must be a scheme in which preferencing the encapsulation to be used
is exchanged between peers. Also, once the softwire encapsulation is
established a minimal amount of information must be passed with
reachability information to connect the AF/SAF reachability to
softwire. The linking of reachability information should not be
passed on a per route basis.
3.6. Security
In contrast with the hubs and spokes problem, routers are advertising
route for relatively large network islands, not individual users, so
fine-grained authentication is not necessary. However the solution
should support security of the softwire mechanism itself or the
softwire data plane or both.
In the softwire initialization mechanism, the softwire solution must
support authentication, but an carrier may decide to turn it off in
some circumstances. This means that if a routing protocol is used to
advertise the softwire encapsulation, it must also support
authentication.
In the data plane, the softwire solution must support IPsec and an
IPsec profile will must be defined. (see recommendations in
[I-D.bellovin-useipsec]).
The verification of the reachability information exchanged and issues
surrounding the security of routing protocols themselves is outside
the scope of the specification.
3.7. Operations and Management
There have been no reports of NATs between the AFBRs (in the transit
core) so a NAT detection solution is not needed.
Other OAM needed features include:
- Usage accounting
- End-point failure detection (must be encapsulated within the tunnel
in the transmitting direction)
Li, et al. Expires September 1, 2006 [Page 19]
Internet-Draft Softwire Problem Statement February 2006
- Path failure detection
Upon failure of a softwire, all reachability information must be
withdrawn or a backup path used immediately.
3.8. Address Family Encapsulations
IPv6/IPv4, IPv4/IPv6 and overlapping address space as defined in the
L3VPN working group (including overlapping RFC-1918 private address
space) are on the critical path for "Mesh" softwires. Other
encapsulations, like IPv6/IPv6, IPv4/IPv4 or IP-only LAN Service
(IPLS) as defined in the L2VPN working group, are nice to have but
not on the critical path.There is no intention to place limits on
additional encapsulations beyond those explicitly mentioned in this
specification.
Li, et al. Expires September 1, 2006 [Page 20]
Internet-Draft Softwire Problem Statement February 2006
4. Security Considerations
Security considerations specific to the "Hubs and Spokes" and "Mesh"
models appear in those sections of the document.
As with any tunneling protocol, using this protocol may introduce a
security issue by circumventing a site security policy implemented as
ingress filtering, since these filters will only be applied to STH AF
IP headers.
Li, et al. Expires September 1, 2006 [Page 21]
Internet-Draft Softwire Problem Statement February 2006
5. IANA Considerations
There are no IANA actions requested in this specification.
Li, et al. Expires September 1, 2006 [Page 22]
Internet-Draft Softwire Problem Statement February 2006
6. Changes from -00
1. Individual-draft authors moved to Authors section, and added an
acknowledgements section.
2. Detailed mailing list comments from Alain Baudot (2005/12/20).
3. Detailed mailing list comments from Pekka Savola (2005/12/22).
4. Detailed mailing list comments from Laurent Toutain
(2005/12/26).
5. Detailed mailing list comments from Francis Dupont (editorial)
(2005/12/29).
6. Detailed mailing list comments from Francis Dupont (non-
editorial) (2005/12/29).
7. Detailed mailing list comments from Tom Pusateri (2005/12/29).
8. Detailed mailing list comments from Tom Alain Durant
(2005/12/30).
9. Changed all occurances of "HGW" to "CPE" and added definitio
10. Removed all occurances of "TEP" (which seemed to be a synonym
for concentrator anyway).
11. Changed all occurances of "ISP" to be "operator".
12. Removed all RFC 2119 language from the specification (since it's
a problem statement).
13. Further linguistic clarificatons and edits (2006/01 and 02)
14. Remove Compare and Contrast section after discussion w/ authors
(2006/02/19)
Li, et al. Expires September 1, 2006 [Page 23]
Internet-Draft Softwire Problem Statement February 2006
7. Acknowledgements
7.1. Authors
The principal authors for this document are: Xing Li, Alain Durand,
Shin Miyakawa, Jordi Palet Martinez, Florent Parent, and David Ward.
7.2. Contributors
The authors would like to acknowledge the following contributors who
provided helpful inputs on earlier versions of this document: Alain
Baudot, Hui Deng, Francis Dupont, Rob Evans, Ed Koehler Jr, Erik
Nordmark, Soohong Daniel Park, Tom Pusateri, Pekka Savola, Bruno
Stevant, Laurent Totain, Bill Storer, Maria (Alice) Dos Santos, Yong
Cui, Chris Metz, Simon Barber, Skip Booth, Scott Wainner and Carl
Williams.
The authors would also like to acknowledge the participants in the
Softwires interim meeting in Paris, France (October 11-12, 2005)
(minutes are at
http://bgp.nu/~dward/softwires/InterimMeetingMinutes.htm).
The authors would also like to express a special acknowledgement and
thanks to Mark Townsley. Without his leadership, persistence,
editing skills and thorough suggestions for the document; we would
have not have been successful.
Tunnel-based transition mechanisms have been under discussion in the
IETF for more than a decade. Initial work related to softwire can be
found in RFC3053. The earlier "V6 Tunnel Configuration" BOF problem
statement [I-D.palet-v6tc-goals-tunneling] includes a reasonable
pointer to prior work.
Li, et al. Expires September 1, 2006 [Page 24]
Internet-Draft Softwire Problem Statement February 2006
8. References
8.1. Normative References
[RFC1700] Postel, "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 1700, October 1994.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2663] Srisuresh, P. and M. Holdrege, "IP Network Address
Translator (NAT) Terminology and Considerations",
RFC 2663, August 1999.
[RFC3041] Narten, T. and R. Draves, "Privacy Extensions for
Stateless Address Autoconfiguration in IPv6", RFC 3041,
January 2001.
[RFC3053] Durand, A., Fasano, P., Guardini, I., and D. Lento, "IPv6
Tunnel Broker", RFC 3053, January 2001.
[RFC3972] Aura, T., "Cryptographically Generated Addresses (CGA)",
RFC 3972, March 2005.
8.2. Informative References
[I-D.bellovin-useipsec]
S, "Guidelines for Mandating the Use of IPsec,
draft-bellovin-useipsec-04", September 2005.
[I-D.durand-naptr-service-discovery]
A, ""Service Discovery using NAPTR records in DNS",
draft-durand-naptr-service-discovery-00", October 2004.
[I-D.ietf-v6ops-ipsec-tunnels]
P, ""Using IPsec to Secure IPv6-in-IPv4 Tunnels",
draft-ietf-v6ops-ipsec-tunnels-01", August 2005.
[I-D.palet-v6ops-solution-tun-auto-disc]
J, ""IPv6 Tunnel End-point Automatic Discovery Mechanism",
draft-palet-v6ops-solution-tun-auto-disc-01",
October 2004.
[I-D.palet-v6ops-tun-auto-disc]
J and M, ""Analysis of IPv6 Tunnel End-point Discovery
Mechanisms", draft-palet-v6ops-tun-auto-disc-03",
January 2005.
Li, et al. Expires September 1, 2006 [Page 25]
Internet-Draft Softwire Problem Statement February 2006
[I-D.palet-v6tc-goals-tunneling]
J, ""Goals for Tunneling Configuration",
draft-palet-v6tc-goals-tunneling-00", February 2005.
Li, et al. Expires September 1, 2006 [Page 26]
Internet-Draft Softwire Problem Statement February 2006
Authors' Addresses
Xing Li
CERNET
Room 225 Main Building, Tsinghua University
Beijing 100084
China
Phone: +86 10 62785983
Fax: +86 10 62785933
Email: xing@cernet.edu.cn
Alain Durand
Comcast
1500 Market st
Philadelphia
PA 19102 USA
Email: Alain_Durand@cable.comcast.com
Dave Ward
Cisco Systems, Inc
170 W. Tasman Dr
San Jose
CA 95134 USA
Email: dward@cisco.com
Spencer Dawkins (editor)
Futurewei Technologies
1700 Alma Drive, Suite 100
Plano, TX 75075
US
Phone: +1 972 509 0309
Fax: +1 469 229 5397
Email: spencer@mcsr-labs.org
Li, et al. Expires September 1, 2006 [Page 27]
Internet-Draft Softwire Problem Statement February 2006
Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Disclaimer of Validity
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright Statement
Copyright (C) The Internet Society (2006). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights.
Acknowledgment
Funding for the RFC Editor function is currently provided by the
Internet Society.
Li, et al. Expires September 1, 2006 [Page 28]
| PAFTECH AB 2003-2026 | 2026-04-23 13:12:55 |