f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntInternet Engineering Task Force (IETF) C. Bao
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRequest for Comments: 6052 CERNET Center/Tsinghua University
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntUpdates: 4291 C. Huitema
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntCategory: Standards Track Microsoft Corporation
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntISSN: 2070-1721 M. Bagnulo
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt M. Boucadair
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt France Telecom
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt CERNET Center/Tsinghua University
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv6 Addressing of IPv4/IPv6 Translators
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt This document discusses the algorithmic translation of an IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt address to a corresponding IPv4 address, and vice versa, using only
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt statically configured information. It defines a well-known prefix
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt for use in algorithmic translations, while allowing organizations to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt also use network-specific prefixes when appropriate. Algorithmic
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translation is used in IPv4/IPv6 translators, as well as other types
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt of proxies and gateways (e.g., for DNS) used in IPv4/IPv6 scenarios.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntStatus of This Memo
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt This is an Internet Standards Track document.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt This document is a product of the Internet Engineering Task Force
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt (IETF). It represents the consensus of the IETF community. It has
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt received public review and has been approved for publication by the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Internet Engineering Steering Group (IESG). Further information on
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Internet Standards is available in Section 2 of RFC 5741.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Information about the current status of this document, any errata,
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt and how to provide feedback on it may be obtained at
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 1]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntCopyright Notice
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Copyright (c) 2010 IETF Trust and the persons identified as the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt document authors. All rights reserved.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt This document is subject to BCP 78 and the IETF Trust's Legal
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Provisions Relating to IETF Documents
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt (http://trustee.ietf.org/license-info) in effect on the date of
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt publication of this document. Please review these documents
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt carefully, as they describe your rights and restrictions with respect
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt to this document. Code Components extracted from this document must
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt include Simplified BSD License text as described in Section 4.e of
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the Trust Legal Provisions and are provided without warranty as
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt described in the Simplified BSD License.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntTable of Contents
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 1.1. Applicability Scope . . . . . . . . . . . . . . . . . . . 3
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 1.2. Conventions . . . . . . . . . . . . . . . . . . . . . . . 4
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 1.3. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 2. IPv4-Embedded IPv6 Address Prefix and Format . . . . . . . . . 5
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 2.1. Well-Known Prefix . . . . . . . . . . . . . . . . . . . . 5
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 2.2. IPv4-Embedded IPv6 Address Format . . . . . . . . . . . . 5
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 2.3. Address Translation Algorithms . . . . . . . . . . . . . . 7
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 2.4. Text Representation . . . . . . . . . . . . . . . . . . . 7
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 3. Deployment Guidelines . . . . . . . . . . . . . . . . . . . . 8
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 3.1. Restrictions on the Use of the Well-Known Prefix . . . . . 8
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 3.2. Impact on Inter-Domain Routing . . . . . . . . . . . . . . 8
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 3.3. Choice of Prefix for Stateless Translation Deployments . . 9
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 3.4. Choice of Prefix for Stateful Translation Deployments . . 11
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 4. Design Choices . . . . . . . . . . . . . . . . . . . . . . . . 12
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 4.1. Choice of Suffix . . . . . . . . . . . . . . . . . . . . . 12
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 4.2. Choice of the Well-Known Prefix . . . . . . . . . . . . . 13
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 5. Security Considerations . . . . . . . . . . . . . . . . . . . 14
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 5.1. Protection against Spoofing . . . . . . . . . . . . . . . 14
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 5.2. Secure Configuration . . . . . . . . . . . . . . . . . . . 15
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 5.3. Firewall Configuration . . . . . . . . . . . . . . . . . . 15
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 16
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 8. Contributors . . . . . . . . . . . . . . . . . . . . . . . . . 16
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 17
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 9.1. Normative References . . . . . . . . . . . . . . . . . . . 17
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 9.2. Informative References . . . . . . . . . . . . . . . . . . 17
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 2]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt1. Introduction
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt This document is part of a series of IPv4/IPv6 translation documents.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt A framework for IPv4/IPv6 translation is discussed in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [v4v6-FRAMEWORK], including a taxonomy of scenarios that will be used
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt in this document. Other documents specify the behavior of various
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt types of translators and gateways, including mechanisms for
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translating between IP headers and other types of messages that
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt include IP addresses. This document specifies how an individual IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt address is translated to a corresponding IPv4 address, and vice
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt versa, in cases where an algorithmic mapping is used. While specific
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt types of devices are used herein as examples, it is the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt responsibility of the specification of such devices to reference this
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt document for algorithmic mapping of the addresses themselves.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Section 2 describes the prefixes and the format of "IPv4-embedded
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv6 addresses", i.e., IPv6 addresses in which 32 bits contain an
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4 address. This format is common to both "IPv4-converted" and
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt "IPv4-translatable" IPv6 addresses. This section also defines the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt algorithms for translating addresses, and the text representation of
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4-embedded IPv6 addresses.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Section 3 discusses the choice of prefixes, the conditions in which
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt they can be used, and the use of IPv4-embedded IPv6 addresses with
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt stateless and stateful translation.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Section 4 provides a summary of the discussions behind two specific
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt design decisions, the choice of a null suffix and the specific value
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt of the selected prefix.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Section 5 discusses security concerns.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt In some scenarios, a dual-stack host will unnecessarily send its
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt traffic through an IPv6/IPv4 translator. This can be caused by the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt host's default address selection algorithm [RFC3484], referrals, or
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt other reasons. Optimizing these scenarios for dual-stack hosts is
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt for future study.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt1.1. Applicability Scope
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt This document is part of a series defining address translation
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt services. We understand that the address format could also be used
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt by other interconnection methods between IPv6 and IPv4, e.g., methods
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt based on encapsulation. If encapsulation methods are developed by
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the IETF, we expect that their descriptions will document their
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt specific use of IPv4-embedded IPv6 addresses.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 3]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt1.2. Conventions
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt document are to be interpreted as described in RFC 2119 [RFC2119].
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt1.3. Terminology
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt This document makes use of the following terms:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Address translator: any entity that has to derive an IPv4 address
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt from an IPv6 address or vice versa. This applies not only to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt devices that do IPv4/IPv6 packet translation, but also to other
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt entities that manipulate addresses, such as name resolution
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt proxies (e.g., DNS64 [DNS64]) and possibly other types of
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Application Layer Gateways (ALGs).
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4-converted IPv6 addresses: IPv6 addresses used to represent IPv4
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt nodes in an IPv6 network. They are a variant of IPv4-embedded
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv6 addresses and follow the format described in Section 2.2.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4-embedded IPv6 addresses: IPv6 addresses in which 32 bits
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt contain an IPv4 address. Their format is described in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Section 2.2.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4/IPv6 translator: an entity that translates IPv4 packets to IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt packets, and vice versa. It may do "stateless" translation,
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt meaning that there is no per-flow state required, or "stateful"
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translation, meaning that per-flow state is created when the first
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt packet in a flow is received.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4-translatable IPv6 addresses: IPv6 addresses assigned to IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt nodes for use with stateless translation. They are a variant of
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4-embedded IPv6 addresses and follow the format described in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Section 2.2.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Network-Specific Prefix: an IPv6 prefix assigned by an organization
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt for use in algorithmic mapping. Options for the Network-Specific
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Prefix are discussed in Sections 3.3 and 3.4.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Well-Known Prefix: the IPv6 prefix defined in this document for use
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt in an algorithmic mapping.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 4]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt2. IPv4-Embedded IPv6 Address Prefix and Format
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt2.1. Well-Known Prefix
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt This document reserves a "Well-Known Prefix" for use in an
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt algorithmic mapping. The value of this IPv6 prefix is:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 64:ff9b::/96
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt2.2. IPv4-Embedded IPv6 Address Format
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4-converted IPv6 addresses and IPv4-translatable IPv6 addresses
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt follow the same format, described here as the IPv4-embedded IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt address Format. IPv4-embedded IPv6 addresses are composed of a
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt variable-length prefix, the embedded IPv4 address, and a variable-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt length suffix, as presented in the following diagram, in which PL
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt designates the prefix length:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt |PL| 0-------------32--40--48--56--64--72--80--88--96--104---------|
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt |32| prefix |v4(32) | u | suffix |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt |40| prefix |v4(24) | u |(8)| suffix |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt |48| prefix |v4(16) | u | (16) | suffix |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt |56| prefix |(8)| u | v4(24) | suffix |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt |64| prefix | u | v4(32) | suffix |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt |96| prefix | v4(32) |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt In these addresses, the prefix shall be either the "Well-Known
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Prefix" or a "Network-Specific Prefix" unique to the organization
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt deploying the address translators. The prefixes can only have one of
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the following lengths: 32, 40, 48, 56, 64, or 96. (The Well-Known
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Prefix is 96 bits long, and can only be used in the last form of the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Various deployments justify different prefix lengths with Network-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Specific Prefixes. The trade-off between different prefix lengths
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt are discussed in Sections 3.3 and 3.4.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 5]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Bits 64 to 71 of the address are reserved for compatibility with the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt host identifier format defined in the IPv6 addressing architecture
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [RFC4291]. These bits MUST be set to zero. When using a /96
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Network-Specific Prefix, the administrators MUST ensure that the bits
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 64 to 71 are set to zero. A simple way to achieve that is to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt construct the /96 Network-Specific Prefix by picking a /64 prefix,
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt and then adding 4 octets set to zero.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The IPv4 address is encoded following the prefix, most significant
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt bits first. Depending of the prefix length, the 4 octets of the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt address may be separated by the reserved octet "u", whose 8 bits MUST
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt be set to zero. In particular:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o When the prefix is 32 bits long, the IPv4 address is encoded in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt positions 32 to 63.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o When the prefix is 40 bits long, 24 bits of the IPv4 address are
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt encoded in positions 40 to 63, with the remaining 8 bits in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt position 72 to 79.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o When the prefix is 48 bits long, 16 bits of the IPv4 address are
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt encoded in positions 48 to 63, with the remaining 16 bits in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt position 72 to 87.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o When the prefix is 56 bits long, 8 bits of the IPv4 address are
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt encoded in positions 56 to 63, with the remaining 24 bits in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt position 72 to 95.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o When the prefix is 64 bits long, the IPv4 address is encoded in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt positions 72 to 103.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o When the prefix is 96 bits long, the IPv4 address is encoded in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt positions 96 to 127.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt There are no remaining bits, and thus no suffix, if the prefix is 96
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt bits long. In the other cases, the remaining bits of the address
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt constitute the suffix. These bits are reserved for future extensions
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt and SHOULD be set to zero. Address translators who receive IPv4-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt embedded IPv6 addresses where these bits are not zero SHOULD ignore
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the bits' value and proceed as if the bits' value were zero. (Future
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt extensions may specify a different behavior.)
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 6]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt2.3. Address Translation Algorithms
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4-embedded IPv6 addresses are composed according to the following
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o Concatenate the prefix, the 32 bits of the IPv4 address, and the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt suffix (if needed) to obtain a 128-bit address.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o If the prefix length is less than 96 bits, insert the null octet
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt "u" at the appropriate position (bits 64 to 71), thus causing the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt least significant octet to be excluded, as documented in Figure 1.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The IPv4 addresses are extracted from the IPv4-embedded IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt addresses according to the following algorithm:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o If the prefix is 96 bits long, extract the last 32 bits of the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv6 address;
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o For the other prefix lengths, remove the "u" octet to obtain a
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 120-bit sequence (effectively shifting bits 72-127 to positions
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 64-119), then extract the 32 bits following the prefix.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt2.4. Text Representation
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4-embedded IPv6 addresses will be represented in text in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt conformity with Section 2.2 of [RFC4291]. IPv4-embedded IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt addresses constructed using the Well-Known Prefix or a /96 Network-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Specific Prefix may be represented using the alternative form
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt presented in Section 2.2 of [RFC4291], with the embedded IPv4 address
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt represented in dotted decimal notation. Examples of such
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt representations are presented in Tables 1 and 2.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +-----------------------+------------+------------------------------+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt | Network-Specific | IPv4 | IPv4-embedded IPv6 address |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt | Prefix | address | |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +-----------------------+------------+------------------------------+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt | 2001:db8::/32 | 192.0.2.33 | 2001:db8:c000:221:: |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt | 2001:db8:100::/40 | 192.0.2.33 | 2001:db8:1c0:2:21:: |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt | 2001:db8:122::/48 | 192.0.2.33 | 2001:db8:122:c000:2:2100:: |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt | 2001:db8:122:300::/56 | 192.0.2.33 | 2001:db8:122:3c0:0:221:: |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt | 2001:db8:122:344::/64 | 192.0.2.33 | 2001:db8:122:344:c0:2:2100:: |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt | 2001:db8:122:344::/96 | 192.0.2.33 | 2001:db8:122:344::192.0.2.33 |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +-----------------------+------------+------------------------------+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Table 1: Text Representation of IPv4-Embedded IPv6 Addresses Using
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Network-Specific Prefixes
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 7]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +-------------------+--------------+----------------------------+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt | Well-Known Prefix | IPv4 address | IPv4-Embedded IPv6 address |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +-------------------+--------------+----------------------------+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt | 64:ff9b::/96 | 192.0.2.33 | 64:ff9b::192.0.2.33 |
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt +-------------------+--------------+----------------------------+
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Table 2: Text Representation of IPv4-Embedded IPv6 Addresses Using
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the Well-Known Prefix
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The Network-Specific Prefix examples in Table 1 are derived from the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv6 prefix reserved for documentation in [RFC3849]. The IPv4
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt address 192.0.2.33 is part of the subnet 192.0.2.0/24 reserved for
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt documentation in [RFC5735]. The representation of IPv6 addresses is
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt compatible with [RFC5952].
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt3. Deployment Guidelines
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt3.1. Restrictions on the Use of the Well-Known Prefix
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The Well-Known Prefix MUST NOT be used to represent non-global IPv4
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt addresses, such as those defined in [RFC1918] or listed in Section 3
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt of [RFC5735]. Address translators MUST NOT translate packets in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt which an address is composed of the Well-Known Prefix and a non-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt global IPv4 address; they MUST drop these packets.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The Well-Known Prefix SHOULD NOT be used to construct IPv4-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translatable IPv6 addresses. The nodes served by IPv4-translatable
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv6 addresses should be able to receive global IPv6 traffic bound to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt their IPv4-translatable IPv6 address without incurring intermediate
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt protocol translation. This is only possible if the specific prefix
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt used to build the IPv4-translatable IPv6 addresses is advertised in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt inter-domain routing, but the advertisement of more specific prefixes
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt derived from the Well-Known Prefix is not supported, as explained in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Section 3.2. Network-Specific Prefixes SHOULD be used in these
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt scenarios, as explained in Section 3.3.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The Well-Known Prefix MAY be used by organizations deploying
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translation services, as explained in Section 3.4.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt3.2. Impact on Inter-Domain Routing
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The Well-Known Prefix MAY appear in inter-domain routing tables, if
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt service providers decide to provide IPv6-IPv4 interconnection
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt services to peers. Advertisement of the Well-Known Prefix SHOULD be
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt controlled either by upstream and/or downstream service providers
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt according to inter-domain routing policies, e.g., through
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 8]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt configuration of BGP [RFC4271]. Organizations that advertise the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Well-Known Prefix in inter-domain routing MUST be able to provide
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4/IPv6 translation service.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt When the IPv4/IPv6 translation relies on the Well-Known Prefix, IPv4-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt embedded IPv6 prefixes longer than the Well-Known Prefix MUST NOT be
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt advertised in BGP (especially External BGP) [RFC4271] because this
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt leads to importing the IPv4 routing table into the IPv6 one and
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt therefore introduces scalability issues to the global IPv6 routing
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt table. Administrators of BGP nodes SHOULD configure filters that
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt discard advertisements of embedded IPv6 prefixes longer than the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Well-Known Prefix.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt When the IPv4/IPv6 translation service relies on Network-Specific
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Prefixes, the IPv4-translatable IPv6 prefixes used in stateless
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translation MUST be advertised with proper aggregation to the IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Internet. Similarly, if translators are configured with multiple
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Network-Specific Prefixes, these prefixes MUST be advertised to the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv6 Internet with proper aggregation.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt3.3. Choice of Prefix for Stateless Translation Deployments
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Organizations may deploy translation services using stateless
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translation. In these deployments, internal IPv6 nodes are addressed
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt using IPv4-translatable IPv6 addresses, which enable them to be
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt accessed by IPv4 nodes. The addresses of these external IPv4 nodes
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt are then represented in IPv4-converted IPv6 addresses.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Organizations deploying stateless IPv4/IPv6 translation SHOULD assign
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt a Network-Specific Prefix to their IPv4/IPv6 translation service.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4-translatable and IPv4-converted IPv6 addresses MUST be
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt constructed as specified in Section 2.2. IPv4-translatable IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt addresses MUST use the selected Network-Specific Prefix. Both IPv4-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translatable IPv6 addresses and IPv4-converted IPv6 addresses SHOULD
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt use the same prefix.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Using the same prefix ensures that IPv6 nodes internal to the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt organization will use the most efficient paths to reach the nodes
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt served by IPv4-translatable IPv6 addresses. Specifically, if a node
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt learns the IPv4 address of a target internal node without knowing
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt that this target is in fact located behind the same translator that
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the node also uses, translation rules will ensure that the IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt address constructed with the Network-Specific Prefix is the same as
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the IPv4-translatable IPv6 address assigned to the target. Standard
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt routing preference (i.e., "most specific match wins") will then
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt ensure that the IPv6 packets are delivered directly, without
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt requiring that translators receive the packets and then return them
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt in the direction from which they came.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 9]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The intra-domain routing protocol must be able to deliver packets to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the nodes served by IPv4-translatable IPv6 addresses. This may
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt require routing on some or all of the embedded IPv4 address bits.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Security considerations detailed in Section 5 require that routers
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt check the validity of the IPv4-translatable IPv6 source addresses,
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt using some form of reverse path check.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The management of stateless address translation can be illustrated
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt with a small example:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt We will consider an IPv6 network with the prefix 2001:db8:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 122::/48. The network administrator has selected the Network-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Specific Prefix 2001:db8:122:344::/64 for managing stateless IPv4/
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv6 translation. The IPv4-translatable address block for IPv4
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt subnet 192.0.2.0/24 is 2001:db8:122:344:c0:2::/96. In this
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt network, the host A is assigned the IPv4-translatable IPv6 address
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 2001:db8:122:344:c0:2:2100::, which corresponds to the IPv4
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt address 192.0.2.33. Host A's address is configured either
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt manually or through DHCPv6.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt In this example, host A is not directly connected to the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translator, but instead to a link managed by a router R. The
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt router R is configured to forward to A the packets bound to 2001:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt db8:122:344:c0:2:2100::. To receive these packets, R will
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt advertise reachability of the prefix 2001:db8:122:344:c0:2:2100::/
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 104 in the intra-domain routing protocol -- or perhaps a shorter
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt prefix if many hosts on link have IPv4-translatable IPv6 addresses
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt derived from the same IPv4 subnet. If a packet bound to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 192.0.2.33 reaches the translator, the destination address will be
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translated to 2001:db8:122:344:c0:2:2100::, and the packet will be
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt routed towards R and then to A.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Let's suppose now that a host B of the same domain learns the IPv4
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt address of A, maybe through an application-specific referral. If
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt B has translation-aware software, B can compose a destination
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt address by combining the Network-Specific Prefix 2001:db8:122:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 344::/64 and the IPv4 address 192.0.2.33, resulting in the address
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 2001:db8:122:344:c0:2:2100::. The packet sent by B will be
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt forwarded towards R, and then to A, avoiding protocol translation.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Forwarding, and reverse path checks, are more efficient when
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt performed on the combination of the prefix and the IPv4 address. In
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt theory, routers are able to route on prefixes of any length, but in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt practice there may be routers for which routing on prefixes larger
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt than 64 bits is slower. However, routing efficiency is not the only
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt consideration in the choice of a prefix length. Organizations also
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt need to consider the availability of prefixes, and the potential
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt impact of all-zero identifiers.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 10]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt If a /32 prefix is used, all the routing bits are contained in the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt top 64 bits of the IPv6 address, leading to excellent routing
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt properties. These prefixes may however be hard to obtain, and
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt allocation of a /32 to a small set of IPv4-translatable IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt addresses may be seen as wasteful. In addition, the /32 prefix and a
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt zero suffix lead to an all-zero interface identifier, which is an
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt issue that we discuss in Section 4.1.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Intermediate prefix lengths such as /40, /48, or /56 appear as
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt compromises. Only some of the IPv4 bits are part of the /64
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt prefixes. Reverse path checks, in particular, may have a limited
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt efficiency. Reverse path checks limited to the most significant bits
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt of the IPv4 address will reduce the possibility of spoofing external
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4 addresses, but would allow IPv6 nodes to spoof internal IPv4-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translatable IPv6 addresses.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt We propose a compromise, based on using no more than 1/256th of an
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt organization's allocation of IPv6 addresses for the IPv4/IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translation service. For example, if the organization is an Internet
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Service Provider with an allocated IPv6 prefix /32 or shorter, the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt ISP could dedicate a /40 prefix to the translation service. An end
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt site with a /48 allocation could dedicate a /56 prefix to the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translation service, or possibly a /96 prefix if all IPv4-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translatable IPv6 addresses are located on the same link.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The recommended prefix length is also a function of the deployment
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt scenario. The stateless translation can be used for Scenario 1,
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Scenario 2, Scenario 5, and Scenario 6 defined in [v4v6-FRAMEWORK].
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt For different scenarios, the prefix length recommendations are:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o For Scenario 1 (an IPv6 network to the IPv4 Internet) and Scenario
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 2 (the IPv4 Internet to an IPv6 network), an ISP holding a /32
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt allocation SHOULD use a /40 prefix, and a site holding a /48
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt allocation SHOULD use a /56 prefix.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o For Scenario 5 (an IPv6 network to an IPv4 network) and Scenario 6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt (an IPv4 network to an IPv6 network), the deployment SHOULD use a
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt /64 or a /96 prefix.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt3.4. Choice of Prefix for Stateful Translation Deployments
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Organizations may deploy translation services based on stateful
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translation technology. An organization may decide to use either a
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Network-Specific Prefix or the Well-Known Prefix for its stateful
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4/IPv6 translation service.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 11]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt When these services are used, IPv6 nodes are addressed through
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt standard IPv6 addresses, while IPv4 nodes are represented by IPv4-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt converted IPv6 addresses, as specified in Section 2.2.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The stateful nature of the translation creates a potential stability
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt issue when the organization deploys multiple translators. If several
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translators use the same prefix, there is a risk that packets
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt belonging to the same connection may be routed to different
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translators as the internal routing state changes. This issue can be
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt avoided either by assigning different prefixes to different
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translators or by ensuring that all translators using the same prefix
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt coordinate their state.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Stateful translation can be used in scenarios defined in
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [v4v6-FRAMEWORK]. The Well-Known Prefix SHOULD be used in these
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt scenarios, with two exceptions:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o In all scenarios, the translation MAY use a Network-Specific
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Prefix, if deemed appropriate for management reasons.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o The Well-Known Prefix MUST NOT be used for Scenario 3 (the IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Internet to an IPv4 network), as this would lead to using the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Well-Known Prefix with non-global IPv4 addresses. That means a
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Network-Specific Prefix (for example, a /96 prefix) MUST be used
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt in that scenario.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt4. Design Choices
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The prefix that we have chosen reflects two design choices, the null
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt suffix and the specific value of the Well-Known Prefix. We provide
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt here a summary of the discussions leading to those two choices.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt4.1. Choice of Suffix
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The address format described in Section 2.2 recommends a zero suffix.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Before making this recommendation, we considered different options:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt checksum neutrality, the encoding of a port range, and a value
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt different than 0.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt In the case of stateless translation, there would be no need for the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translator to recompute a one's complement checksum if both the IPv4-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt translatable and the IPv4-converted IPv6 addresses were constructed
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt in a "checksum-neutral" manner, that is, if the IPv6 addresses would
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt have the same one's complement checksum as the embedded IPv4 address.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt In the case of stateful translation, checksum neutrality does not
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt eliminate checksum computation during translation, as only one of the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt two addresses would be checksum neutral. We considered reserving 16
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt bits in the suffix to guarantee checksum neutrality, but declined
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 12]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt because it would not help with stateful translation and because
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt checksum neutrality can also be achieved by an appropriate choice of
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the Network-Specific Prefix, i.e., selecting a prefix whose one's
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt complement checksum equals either 0 or 0xffff.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt There have been proposals to complement stateless translation with a
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt port-range feature. Instead of mapping an IPv4 address to exactly
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt one IPv6 prefix, the options would allow several IPv6 nodes to share
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt an IPv4 address, with each node managing a different range of ports.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt If a port range extension is needed, it could be defined later, using
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt bits currently reserved as null in the suffix.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt When a /32 prefix is used, an all-zero suffix results in an all-zero
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt interface identifier. We understand the conflict with Section 2.6.1
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt of RFC4291, which specifies that all zeroes are used for the subnet-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt router anycast address. However, in our specification, there is only
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt one node with an IPv4-translatable IPv6 address in the /64 subnet, so
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the anycast semantic does not create confusion. We thus decided to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt keep the null suffix for now. This issue does not exist for prefixes
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt larger than 32 bits, such as the /40, /56, /64, and /96 prefixes that
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt we recommend in Section 3.3.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt4.2. Choice of the Well-Known Prefix
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Before making our recommendation of the Well-Known Prefix, we were
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt faced with three choices:
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o reuse the IPv4-mapped prefix, ::ffff:0:0/96, as specified in RFC
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 2765, Section 2.1;
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o request IANA to allocate a /32 prefix, or
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt o request allocation of a new /96 prefix.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt We weighted the pros and cons of these choices before settling on the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt recommended /96 Well-Known Prefix.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The main advantage of the existing IPv4-mapped prefix is that it is
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt already defined. Reusing that prefix would require minimal
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt standardization efforts. However, being already defined is not just
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt an advantage, as there may be side effects of current
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt implementations. When presented with the IPv4-mapped prefix, current
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt versions of Windows and Mac OS generate IPv4 packets, but will not
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt send IPv6 packets. If we used the IPv4-mapped prefix, these nodes
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt would not be able to support translation without modification. This
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt will defeat the main purpose of the translation techniques. We thus
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt eliminated the first choice, i.e., decided to not reuse the IPv4-
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt mapped prefix, ::ffff:0:0/96.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 13]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt A /32 prefix would have allowed the embedded IPv4 address to fit
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt within the top 64 bits of the IPv6 address. This would have
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt facilitated routing and load balancing when an organization deploys
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt several translators. However, such destination-address-based load
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt balancing may not be desirable. It is not compatible with Session
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Traversal Utilities for NAT (STUN) [RFC5389] in the deployments
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt involving multiple stateful translators, each one having a different
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt pool of IPv4 addresses. STUN compatibility would only be achieved if
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the translators managed the same pool of IPv4 addresses and were able
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt to coordinate their translation state, in which case there is no big
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt advantage to using a /32 prefix rather than a /96 prefix.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt According to Section 2.2 of [RFC4291], in the legal textual
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt representations of IPv6 addresses, dotted decimal can only appear at
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the end. The /96 prefix is compatible with that requirement. It
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt enables the dotted decimal notation without requiring an update to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [RFC4291]. This representation makes the address format easier to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt use and the log files easier to read.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The prefix that we recommend has the particularity of being "checksum
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt neutral". The sum of the hexadecimal numbers "0064" and "ff9b" is
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt "ffff", i.e., a value equal to zero in one's complement arithmetic.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt An IPv4-embedded IPv6 address constructed with this prefix will have
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt the same one's complement checksum as the embedded IPv4 address.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt5. Security Considerations
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt5.1. Protection against Spoofing
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4/IPv6 translators can be modeled as special routers, are subject
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt to the same risks, and can implement the same mitigations. (The
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt discussion of generic threats to routers and their mitigations is
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt beyond the scope of this document.) There is, however, a particular
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt risk that directly derives from the practice of embedding IPv4
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt addresses in IPv6: address spoofing.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt An attacker could use an IPv4-embedded IPv6 address as the source
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt address of malicious packets. After translation, the packets will
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt appear as IPv4 packets from the specified source, and the attacker
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt may be hard to track. If left without mitigation, the attack would
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt allow malicious IPv6 nodes to spoof arbitrary IPv4 addresses.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The mitigation is to implement reverse path checks and to verify
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt throughout the network that packets are coming from an authorized
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 14]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt5.2. Secure Configuration
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The prefixes used for address translation are used by IPv6 nodes to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt send packets to IPv6/IPv4 translators. Attackers could attempt to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt fool nodes, DNS gateways, and IPv4/IPv6 translators into using wrong
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt values for these parameters, resulting in network disruption, denial
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt of service, and possible information disclosure. To mitigate such
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt attacks, network administrators need to ensure that prefixes are
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt configured in a secure way.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The mechanisms for achieving secure configuration of prefixes are
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt beyond the scope of this document.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt5.3. Firewall Configuration
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Many firewalls and other security devices filter traffic based on
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4 addresses. Attackers could attempt to fool these firewalls by
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt sending IPv6 packets to or from IPv6 addresses that translate to the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt filtered IPv4 addresses. If the attack is successful, traffic that
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt was previously blocked might be able to pass through the firewalls
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt disguised as IPv6 packets. In all such scenarios, administrators
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt should assure that packets that send to or from IPv4-embedded IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt addresses are subject to the same filtering as those directly sent to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt or from the embedded IPv4 addresses.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The mechanisms for configuring firewalls and security devices to
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt achieve this filtering are beyond the scope of this document.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt6. IANA Considerations
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IANA has made the following changes in the "Internet Protocol Version
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 6 Address Space" registry located at http://www.iana.org.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv6 Prefix Allocation Reference Note
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt ----------- ---------------- ------------ ----------------
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 0000::/8 Reserved by IETF [RFC4291] [1][5]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv6 Prefix Allocation Reference Note
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt ----------- ---------------- ------------ ----------------
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 0000::/8 Reserved by IETF [RFC4291] [1][5][6]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [6] The "Well-Known Prefix" 64:ff9b::/96 used in an algorithmic
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt mapping between IPv4 to IPv6 addresses is defined out of the
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 0000::/8 address block, per RFC 6052.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 15]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt7. Acknowledgements
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Many people in the BEHAVE WG have contributed to the discussion that
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt led to this document, including Andrew Sullivan, Andrew Yourtchenko,
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Ari Keranen, Brian Carpenter, Charlie Kaufman, Dan Wing, Dave Thaler,
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt David Harrington, Ed Jankiewicz, Fred Baker, Hiroshi Miyata, Iljitsch
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt van Beijnum, John Schnizlein, Keith Moore, Kevin Yin, Magnus
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Westerlund, Margaret Wasserman, Masahito Endo, Phil Roberts, Philip
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Matthews, Remi Denis-Courmont, Remi Despres, and William Waites.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Marcelo Bagnulo is partly funded by Trilogy, a research project
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt supported by the European Commission under its Seventh Framework
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt8. Contributors
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt The following individuals co-authored documents from which text has
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt been incorporated, and are listed in alphabetical order.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Microsoft Corporation
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt One Microsoft Way
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Redmond, WA 98052
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Phone: +1 425 703 8835
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt EMail: dthaler@microsoft.com
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Cisco Systems
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Santa Barbara, California 93117
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Phone: +1-408-526-4257
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Fax: +1-413-473-2403
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt EMail: fred@cisco.com
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Hiroshi Miyata
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Yokogawa Electric Corporation
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 2-9-32 Nakacho
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Musashino-shi, Tokyo 180-8750
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt EMail: h.miyata@jp.yokogawa.com
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 16]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt9. References
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt9.1. Normative References
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Requirement Levels", BCP 14, RFC 2119, March 1997.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [RFC4291] Hinden, R. and S. Deering, "IP Version 6 Addressing
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Architecture", RFC 4291, February 2006.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt9.2. Informative References
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [DNS64] Bagnulo, M., Sullivan, A., Matthews, P., and I. Beijnum,
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt "DNS64: DNS extensions for Network Address Translation
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt from IPv6 Clients to IPv4 Servers", Work in Progress,
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt October 2010.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt E. Lear, "Address Allocation for Private Internets",
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt BCP 5, RFC 1918, February 1996.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [RFC3484] Draves, R., "Default Address Selection for Internet
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Protocol version 6 (IPv6)", RFC 3484, February 2003.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [RFC3849] Huston, G., Lord, A., and P. Smith, "IPv6 Address Prefix
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Reserved for Documentation", RFC 3849, July 2004.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [RFC4271] Rekhter, Y., Li, T., and S. Hares, "A Border Gateway
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Protocol 4 (BGP-4)", RFC 4271, January 2006.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [RFC5389] Rosenberg, J., Mahy, R., Matthews, P., and D. Wing,
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt "Session Traversal Utilities for NAT (STUN)", RFC 5389,
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt October 2008.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [RFC5735] Cotton, M. and L. Vegoda, "Special Use IPv4 Addresses",
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt BCP 153, RFC 5735, January 2010.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [RFC5952] Kawamura, S. and M. Kawashima, "A Recommendation for IPv6
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Address Text Representation", RFC 5952, August 2010.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt [v4v6-FRAMEWORK]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Baker, F., Li, X., Bao, C., and K. Yin, "Framework for
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt IPv4/IPv6 Translation", Work in Progress, August 2010.
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 17]
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntRFC 6052 IPv6 Addressing of IPv4/IPv6 Translators October 2010
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntAuthors' Addresses
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Congxiao Bao
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt CERNET Center/Tsinghua University
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Room 225, Main Building, Tsinghua University
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Beijing, 100084
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Phone: +86 10-62785983
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt EMail: congxiao@cernet.edu.cn
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Christian Huitema
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Microsoft Corporation
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt One Microsoft Way
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Redmond, WA 98052-6399
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt EMail: huitema@microsoft.com
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Marcelo Bagnulo
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Av. Universidad 30
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Leganes, Madrid 28911
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Phone: +34-91-6249500
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt EMail: marcelo@it.uc3m.es
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Mohamed Boucadair
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt France Telecom
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt 3, Av Francois Chateaux
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Rennes 350000
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt EMail: mohamed.boucadair@orange-ftgroup.com
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt CERNET Center/Tsinghua University
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Room 225, Main Building, Tsinghua University
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Beijing, 100084
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt Phone: +86 10-62785983
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan Hunt EMail: xing@cernet.edu.cn
f2ea8c2f965be7ff4c59f805712c12d469226b7bEvan HuntBao, et al. Standards Track [Page 18]