One document matched: draft-maglione-softwire-dslite-radius-ext-00.xml
<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!ENTITY rfc2119 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY rfc2865 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2865.xml">
<!ENTITY __reference.RFC.2869__g60i1uxb SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2869.xml">
]>
<?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?>
<?rfc toc="yes"?>
<?rfc compact="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes" ?>
<?rfc strict="yes" ?>
<?rfc linkmailto="yes" ?>
<rfc category="std" docName="draft-maglione-softwire-dslite-radius-ext-00"
ipr="pre5378Trust200902">
<front>
<title abbrev="DS-Lite RADIUS Extensions">RADIUS Extensions for Dual-Stack
Lite</title>
<author fullname="Roberta Maglione" initials="R." surname="Maglione">
<organization abbrev="">Telecom Italia</organization>
<address>
<postal>
<street>Via Reiss Romoli 274</street>
<city>Torino</city>
<code>10148</code>
<country>Italy</country>
</postal>
<phone></phone>
<email>roberta.maglione@telecomitalia.it</email>
</address>
</author>
<author fullname="Alain Durand" initials="A." surname="Durand">
<organization>Juniper Networks</organization>
<address>
<postal>
<street></street>
<city></city>
<region></region>
<code></code>
<country></country>
</postal>
<phone></phone>
<facsimile></facsimile>
<email>adurand@juniper.net</email>
<uri></uri>
</address>
</author>
<date month="July" year="2010" />
<area>Internet</area>
<workgroup>softwire</workgroup>
<abstract>
<t>Dual-Stack Lite is a solution to offer both IPv4 and IPv6
connectivity to customers which are addressed only with an IPv6 prefix.
DS-Lite requires to pre-configure the AFTR tunnel information on the B4
element. In many networks, the customer profile information may be
stored in AAA servers while client configurations are mainly provided
through DHC protocol. This document specifies two new RADIUS attributes
to carry Dual-Stack Lite Address Family Transition Router (AFTR) IPv6
address and name; the RADIUS attributes are defined based on the
equivalent DHCPv6 options already specified in
draft-ietf-softwire-ds-lite-tunnel-option. These RADIUS attributes are
meant to be used between the RADIUS Server and the NAS, they are not
intended to be used directly between the B4 element and the RADIUS
Server.</t>
</abstract>
</front>
<middle>
<section anchor="intro" title="Introduction">
<t>Dual-Stack Lite <xref
target="I-D.ietf-softwire-dual-stack-lite"></xref> is a solution to
offer both IPv4 and IPv6 connectivity to customers which are addressed
only with an IPv6 prefix (no IPv4 address is assigned to the attachment
device). One of its key components is an IPv4-over-IPv6 tunnel, but a
DS-Lite Basic Bridging BroadBand (B4) will not know if the network it is
attached to offers Dual-Stack Lite support, and if it did, would not
know the remote end of the tunnel to establish a connection.</t>
<t>To inform the B4 of the AFTR's location, either an IPv6 address or
Fully Qualified Domain Name (FQDN) may be used. Once this information is
conveyed, the presence of the configuration indicating the AFTR's
location also informs a host to initiate Dual-Stack Lite (DS-Lite)
service and become a Softwire Initiator.</t>
<t>The draft draft-ietf-softwire-ds-lite-tunnel-option <xref
target="I-D.ietf-softwire-ds-lite-tunnel-option"></xref> specifies two
DHCPv6 options which are meant to be used by a Dual-Stack Lite client
(Basic Bridging BroadBand element, B4) to discover its Address Family
Transition Router (AFTR) address. In order to be able to populate such
options the DHCPv6 Server must be pre-provisioned with the Address
Family Transition Router (AFTR) address or name.</t>
<t>In Broadband environments, customer profile may be managed by AAA
servers, together with user Authentication, Authorization, and
Accounting (AAA). RADIUS protocol <xref target="RFC2865"></xref> is
usually used by AAA Servers to communicate with network elements. <xref
target="I-D.ietf-radext-ipv6-access"></xref> describes a typical
broadband network scenario in which the Network Access Server (NAS) acts
as the access gateway for the users (hosts or CPEs) and the NAS embeds a
DHCPv6 Server function that allows it to locally handle any DHCPv6
requests issued by the clients. </t>
<t>Since the DS-Lite AFTR information can be stored in AAA servers and
the client configuration is mainly provided through DHC protocol running
between the NAS and the requesting clients, new RADIUS attributes are
needed to send AFTR information from AAA server to the NAS.</t>
<t>This document aims at defining two new RADIUS attributes to be used
for carrying the DS-Lite Tunnel Name and DS-Lite Tunnel Address, based
on the equivalent DHCPv6 options already specified in <xref
target="I-D.ietf-softwire-ds-lite-tunnel-option"></xref></t>
</section>
<!-- intro -->
<section anchor="term" title="Terminology">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <xref
target="RFC2119"></xref>.</t>
<t>The terms DS-Lite Basic Bridging BroadBand element (B4) and the
DS-Lite Address Family Transition Router element (AFTR) are defined in
<xref target="I-D.ietf-softwire-dual-stack-lite"></xref></t>
</section>
<section title="DS-Lite Configuration with RADIUS and DHCPv6">
<t>The <xref target="fig1"></xref> illustrates how the RADIUS protocol
and DHCPv6 work together to accomplish DS-Lite configuration on the B4
element.</t>
<t><figure anchor="fig1" height=""
title="RADIUS and DHCPv6 Message Flow">
<artwork><![CDATA[ B4 NAS AAA
| | Server
| | |
| | |
| |-----Access Request -------->|
| | |
| |<----Access Accept(
| | DS-Lite-Tunnel-Add |
| | DS-Lite-Tunnel-Name) |
| | |
|------DHCPv6 Request----->| |
| (DS-Lite tunnel Option) | |
| | |
|<-----DHCPv6 Reply--------| |
| (DS-Lite tunnel option) | |
DHCPv6 RADIUS
]]></artwork>
</figure></t>
<t>The Network Access Server (NAS) operates as a client of RADIUS and as
DHCP Server for DHC protocol. The NAS initially sends a RADIUS Access
Request message to the RADIUS server, requesting authentication. Once
the RADIUS server receives the request, it validates the sending client
and if the request is approved, the AAA server replies with an Access
Accept message including a list of attribute-value pairs that describe
the parameters to be used for this session. This list may also contain
the AFTR Tunnel IPv6 Address and/or the AFTR Tunnel Name. When the NAS
receives a DHCPv6 client request containing the DS-Lite tunnel Option,
the NAS shall use the address returned in the RADIUS DS-Lite-Tunnel-Addr
attribute to populate the DHCPv6 OPTION_DS_LITE_ADDR option in the
DHCPv6 reply message.</t>
</section>
<!-- term -->
<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -->
<section anchor="Attrib" title="Attributes">
<t>This section specifies the format of the two new RADIUS
attributes.</t>
<section anchor="DSLITE-Addr" title="DS-Lite-Tunnel-Addr">
<t>Description</t>
<t>The DS-Lite-Tunnel-Addr RADIUS attribute contains a 128 bit IPv6
address that identifies the location of the remote tunnel endpoint,
expected to be located at an AFTR. The NAS shall use the address
returned in the RADIUS DS-Lite-Tunnel-Addr attribute to populate the
DHCPv6 OPTION_DS_LITE_ADDR option <xref
target="I-D.ietf-softwire-ds-lite-tunnel-option"></xref>.</t>
<t>This attribute MAY be used in Access-Accept packets and it MAY be
present in Accounting-Request records where the Acct-Status-Type is
set to Start, Stop or Interim-Update. The DS-Lite-Tunnel-Addr RADIUS
attribute and MUST NOT appear more than once in a message.</t>
<t>A summary of the DS-Lite-Tunnel-Addr RADIUS attribute format is
shown below. The fields are transmitted from left to right.</t>
<figure>
<preamble></preamble>
<artwork><![CDATA[ 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | DS-Lite-Tunnel-Addr |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| DS-Lite-Tunnel-Addr (IPv6 Address)(cont) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork>
<postamble></postamble>
</figure>
<t>Type:</t>
<t><list counter="1" hangIndent="5">
<t>TBA1 for DS-Lite-Tunnel-Addr.</t>
</list>Length: <list counter="1" hangIndent="5">
<t>16 octets</t>
</list></t>
<t>DS-Lite-Tunnel-Addr:<list counter="1" hangIndent="5">
<t>A 128-bit IPv6 address of the DS-Lite AFTR.</t>
</list></t>
<t></t>
<!-- ProvSnd -->
<!-- ProvRecv -->
</section>
<section anchor="DSLITE-Name" title=" DS-Lite-Tunnel-Name ">
<t>Description</t>
<t>The DS-Lite-Tunnel-Name RADIUS attribute contains a Fully Qualified
Domain Name that refers to the AFTR the client is requested to
establish a connection with. The NAS shall use the name returned in
the RADIUS DS-Lite-Tunnel-Name attribute to populate the DHCPv6
OPTION_DS_LITE_NAME option <xref
target="I-D.ietf-softwire-ds-lite-tunnel-option"></xref></t>
<t>This attribute MAY be used in Access-Accept packets and it MAY be
present in Accounting-Request records where the Acct-Status-Type is
set to Start, Stop or Interim-Update. The DS-Lite-Tunnel-Name RADIUS
attribute and MUST NOT appear more than once in a message.</t>
<t>A summary of the DS-Lite-Tunnel-Name RADIUS attribute format is
shown below. The fields are transmitted from left to right.</t>
<figure>
<preamble></preamble>
<artwork><![CDATA[ 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | DS-Lite-Tunnel-Name (FQDN) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| DS-Lite-Tunnel-Name (FQDN) (cont) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork>
<postamble></postamble>
</figure>
<t>Type:</t>
<t><list counter="1" hangIndent="5">
<t>TBA2 for DS-Lite-Tunnel-Name.</t>
</list>Length: <list counter="1" hangIndent="5">
<t>Length in octets of the DS-Lite-Tunnel-Name (FQDN)</t>
</list></t>
<t>DS-Lite-Tunnel-Name:<list counter="1" hangIndent="5">
<t>A single Fully Qualified Domain Name of the remote tunnel
endpoint, located at the DS-Lite AFTR.</t>
</list></t>
<t></t>
<!-- ProvSnd -->
<!-- ProvRecv -->
</section>
</section>
<section anchor="seccons" title="Security Considerations">
<t>This document has no additional security considerations beyond those
already identified in <xref target="RFC2865"></xref></t>
<t><xref target="I-D.ietf-softwire-dual-stack-lite"></xref> discusses
DS-Lite related security issues.</t>
</section>
<section anchor="IANA" title="IANA Considerations">
<t>This document requests the allocation of two new Radius attribute
types from the IANA registry "Radius Attribute Types" located at
http://www.iana.org/assignments/radius-types</t>
<t><list>
<t>DS-Lite-Tunnel-Addr - TBA1</t>
<t>DS-Lite-Tunnel-Name - TBA2</t>
</list></t>
</section>
</middle>
<back>
<references title="Normative References">
&rfc2119;
<?rfc include='reference.I-D.ietf-softwire-dual-stack-lite'?>
<?rfc include='reference.I-D.ietf-softwire-ds-lite-tunnel-option'?>
<?rfc include='reference.I-D.ietf-radext-ipv6-access'?>
&rfc2865;
<?rfc ?>
</references>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-24 04:26:04 |