10. IA_PD Prefix option
The IA_PD Prefix option is used to specify IPv6 address prefixes
associated with an IA_PD. The IA_PD Prefix option must be
encapsulated in the IA_PD-options field of an IA_PD option.
The format of the IA_PD Prefix option is:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_IAPREFIX | option-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| preferred-lifetime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| valid-lifetime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| prefix-length | |
+-+-+-+-+-+-+-+-+ IPv6 prefix |
| (16 octets) |
| |
| |
| |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | .
+-+-+-+-+-+-+-+-+ .
. IAprefix-options .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
option-code: OPTION_IAPREFIX (26)
option-length: 25 + length of IAprefix-options field
preferred-lifetime: The recommended preferred lifetime for the IPv6
prefix in the option, expressed in units of
seconds. A value of 0xFFFFFFFF represents
infinity.
valid-lifetime: The valid lifetime for the IPv6 prefix in the
option, expressed in units of seconds. A value of
0xFFFFFFFF represents infinity.
prefix-length: Length for this prefix in bits
IPv6-prefix: An IPv6 prefix
IAprefix-options: Options associated with this prefix
In a message sent by a requesting router to a delegating router, the
values in the fields can be used to indicate the requesting router’s
preference for those values. The requesting router may send a value
of zero to indicate no preference. A requesting router may set the
IPv6 prefix field to zero and a given value in the prefix-length
field to indicate a preference for the size of the prefix to be
delegated.
In a message sent by a delegating router the preferred and valid
lifetimes should be set to the values of AdvPreferredLifetime and
AdvValidLifetime as specified in section 6.2.1, "Router Configuration
Variables" of RFC 2461 [4], unless administratively configured.
A requesting router discards any prefixes for which the preferred
lifetime is greater than the valid lifetime. A delegating router
ignores the lifetimes set by the requesting router if the preferred
lifetime is greater than the valid lifetime and ignores the values
for T1 and T2 set by the requesting router if those values are
greater than the preferred lifetime.
The values in the preferred and valid lifetimes are the number of
seconds remaining for each lifetime.
An IA_PD Prefix option may appear only in an IA_PD option. More than
one IA_PD Prefix Option can appear in a single IA_PD option.
The status of any operations involving this IA_PD Prefix option is
indicated in a Status Code option in the IAprefix-options field.
11. Delegating Router Solicitation
The requesting router locates and selects a delegating router in the
same way as described in section 17, "DHCP Server Solicitation" of
RFC 3315. The details of the solicitation process are described in
this section.
11.1. Requesting router behavior
The requesting router creates and transmits a Solicit message as
described in sections 17.1.1, "Creation of Solicit Messages" and
17.1.2, "Transmission of Solicit Messages" of RFC 3315. The
requesting router creates an IA_PD and assigns it an IAID. The
requesting router MUST include the IA_PD option in the Solicit
message.
The requesting router processes any received Advertise messages as
described in section 17.1.3, "Receipt of Advertise Messages" of RFC
3315. The requesting router MAY choose to consider the presence of
advertised prefixes in its decision about which delegating router to
respond to.
The requesting router MUST ignore any Advertise message that includes
a Status Code option containing the value NoPrefixAvail, with the
exception that the requesting router MAY display the associated
status message to the user.
11.2. Delegating router behavior
The delegating router sends an Advertise message to the requesting
router in the same way as described in section 17.2.2, "Creation and
transmission of Advertise messages" of RFC 3315. If the message
contains an IA_PD option and the delegating router is configured to
delegate prefix(es) to the requesting router, the delegating router
selects the prefix(es) to be delegated to the requesting router. The
mechanism through which the delegating router selects prefix(es) for
delegation is not specified in this document. Examples of ways in
which the delegating router might select prefix(es) for a requesting
router include: static assignment based on subscription to an ISP;
dynamic assignment from a pool of available prefixes; selection based
on an external authority such as a RADIUS server using the Framed-
IPv6-Prefix option as described in RFC 3162 [5].
If the requesting router includes an IA_PD Prefix option in the IA_PD
option in its Solicit message, the delegating router MAY choose to
use the information in that option to select the prefix(es) or prefix
size to be delegated to the requesting router.
The delegating router sends an Advertise message to the requesting
router in the same way as described in section, "Creation and
transmission of Advertise messages" of RFC 3315. The delegating
router MUST include an IA_PD option, identifying any prefix(es) that
the delegating router will delegate to the requesting router.
If the delegating router will not assign any prefixes to any IA_PDs
in a subsequent Request from the requesting router, the delegating
router MUST send an Advertise message to the requesting router that
includes the IA_PD with no prefixes in the IA_PD and a Status Code
option in the IA_PD containing status code NoPrefixAvail and a status
message for the user, a Server Identifier option with the delegating
router’s DUID and a Client Identifier option with the requesting
router’s DUID.
12. Requesting router initiated prefix delegation
A requesting router uses the same message exchanges as described in
section 18, "DHCP Client-Initiated Configuration Exchange" of RFC
3315 to obtain or update prefix(es) from a delegating router. The
requesting router and the delegating router use the IA_PD Prefix
option to exchange information about prefix(es) in much the same way
IA Address options are used for assigned addresses.
12.1. Requesting router behavior
The requesting router uses a Request message to populate IA_PDs with
prefixes. The requesting router includes one or more IA_PD options
in the Request message. The delegating router then returns the
prefixes for the IA_PDs to the requesting router in IA_PD options in
a Reply message.
The requesting router includes IA_PD options in any Renew, or Rebind
messages sent by the requesting router. The IA_PD option includes
all of the prefixes the requesting router currently has associated
with that IA_PD.
In some circumstances the requesting router may need verification
that the delegating router still has a valid binding for the
requesting router. Examples of times when a requesting router may
ask for such verification include:
o The requesting router reboots.
o The requesting router’s upstream link flaps.
o The requesting router is physically disconnected from a wired
connection.
If such verification is needed the requesting router MUST initiate a
Rebind/Reply message exchange as described in section 18.1.4,
"Creation and Transmission of Rebind Messages" of RFC 3315, with the
exception that the retransmission parameters should be set as for the
Confirm message, described in section 18.1.2, "Creation and
Transmission of Confirm Messages" of RFC 3315. The requesting router
includes any IA_PDs, along with prefixes associated with those IA_PDs
in its Rebind message.
Each prefix has valid and preferred lifetimes whose durations are
specified in the IA_PD Prefix option for that prefix. The requesting
router uses Renew and Rebind messages to request the extension of the
lifetimes of a delegated prefix.
The requesting router uses a Release message to return a delegated
prefix to a delegating router. The prefixes to be released MUST be
included in the IA_PDs.
The Confirm and Decline message types are not used with Prefix
Delegation.
Upon the receipt of a valid Reply message, for each IA_PD the
requesting router assigns a subnet from each of the delegated
prefixes to each of the links to which the associated interfaces are
attached, with the following exception: the requesting router MUST
NOT assign any delegated prefixes or subnets from the delegated
prefix(es) to the link through which it received the DHCP message
from the delegating router.
When a requesting router subnets a delegated prefix, it must assign
additional bits to the prefix to generate unique, longer prefixes.
For example, if the requesting router in Figure 1 were delegated
3FFE:FFFF:0::/48, it might generate 3FFE:FFFF:0:1::/64 and
3FFE:FFFF:0:2::/64 for assignment to the two links in the subscriber
network. If the requesting router were delegated 3FFE:FFFF:0::/48
and 3FFE:FFFF:5::/48, it might assign 3FFE:FFFF:0:1::/64 and
3FFE:FFFF:5:1::/64 to one of the links, and 3FFE:FFFF:0:2::/64 and
3FFE:FFFF:5:2::/64 for assignment to the other link.
If the requesting router assigns a delegated prefix to a link to
which the router is attached, and begins to send router
advertisements for the prefix on the link, the requesting router MUST
set the valid lifetime in those advertisements to be no later than
the valid lifetime specified in the IA_PD Prefix option. A
requesting router MAY use the preferred lifetime specified in the
IA_PD Prefix option.
Handling of Status Codes options in received Reply messages is
described in section 18.1.8, "Receipt of Reply Messages" of RFC 3315.
The NoPrefixAvail Status Code is handled in the same manner as the
NoAddrsAvail Status Code.
12.2. Delegating Router behavior
When a delegating router receives a Request message from a requesting
router that contains an IA_PD option, and the delegating router is
authorized to delegate prefix(es) to the requesting router, the
delegating router selects the prefix(es) to be delegated to the
requesting router. The mechanism through which the delegating router
selects prefix(es) for delegation is not specified in this document.
Section 11.2 gives examples of ways in which a delegating router
might select the prefix(es) to be delegated to a requesting router.
A delegating router examines the prefix(es) identified in IA_PD
Prefix options (in an IA_PD option) in Renew and Rebind messages and
responds according to the current status of the prefix(es). The
delegating router returns IA_PD Prefix options (within an IA_PD
option) with updated lifetimes for each valid prefix in the message
from the requesting router. If the delegating router finds that any
of the prefixes are not in the requesting router’s binding entry, the
delegating router returns the prefix to the requesting router with
lifetimes of 0.
The delegating router behaves as follows when it cannot find a
binding for the requesting router’s IA_PD:
Renew message: If the delegating router cannot find a binding
for the requesting router’s IA_PD the delegating
router returns the IA_PD containing no prefixes
with a Status Code option set to NoBinding in the
Reply message.
Rebind message: If the delegating router cannot find a binding
for the requesting router’s IA_PD and the
delegating router determines that the prefixes in
the IA_PD are not appropriate for the link to
which the requesting router’s interface is
attached according to the delegating routers
explicit configuration, the delegating router MAY
send a Reply message to the requesting router
containing the IA_PD with the lifetimes of the
prefixes in the IA_PD set to zero. This Reply
constitutes an explicit notification to the
requesting router that the prefixes in the IA_PD
are no longer valid. If the delegating router is
unable to determine if the prefix is not
appropriate for the link, the Rebind message is
discarded.
A delegating router may mark any prefix(es) in IA_PD Prefix options
in a Release message from a requesting router as "available",
dependent on the mechanism used to acquire the prefix, e.g., in the
case of a dynamic pool.
The delegating router MUST include an IA_PD Prefix option or options
(in an IA_PD option) in Reply messages sent to a requesting router.
13. Prefix Delegation reconfiguration
This section describes prefix delegation in Reconfigure message
exchanges.
13.1. Delegating Router behavior
The delegating router initiates a configuration message exchange with
a requesting router, as described in section 19, "DHCP Server-
Initiated Configuration Exchange" of RFC 3315, by sending a
Reconfigure message (acting as a DHCP server) to the requesting
router, as described in section 19.1, "Server Behavior" of RFC 3315.
The delegating router specifies the IA_PD option in the Option
Request option to cause the requesting router to include an IA_PD
option to obtain new information about delegated prefix(es).
13.2. Requesting Router behavior
The requesting router responds to a Reconfigure message, acting as a
DHCP client, received from a delegating router as described in
section 19.4, "Client Behavior" of RFC 3315. The requesting router
MUST include the IA_PD Prefix option(s) (in an IA_PD option) for
prefix(es) that have been delegated to the requesting router by the
delegating router from which the Reconfigure message was received.
14. Relay agent behavior
A relay agent forwards messages containing Prefix Delegation options
in the same way as described in section 20, "Relay Agent Behavior" of
RFC 3315.
If a delegating router communicates with a requesting router through
a relay agent, the delegating router may need a protocol or other
out-of-band communication to add routing information for delegated
prefixes into the provider edge router.
15. Security Considerations
Security considerations in DHCP are described in section 23,
"Security Considerations" of RFC 3315.
A rogue delegating router can issue bogus prefixes to a requesting
router. This may cause denial of service due to unreachability.
A malicious requesting router may be able to mount a denial of
service attack by repeated requests for delegated prefixes that
exhaust the delegating router’s available prefixes.
To guard against attacks through prefix delegation, requesting
routers and delegating routers SHOULD use DHCP authentication as
described in section 21, "Authentication of DHCP messages" of RFC
3315. For point to point links, where one trusts that there is no
man in the middle, or one trusts layer two authentication, DHCP
authentication or IPsec may not be necessary. Because a requesting
router and delegating routers must each have at least one assigned
IPv6 address, the routers may be able to use IPsec for authentication
of DHCPv6 messages. The details of using IPsec for DHCPv6 are under
development.
Networks configured with delegated prefixes should be configured to
preclude intentional or inadvertent inappropriate advertisement of
these prefixes.
16. IANA Considerations
IANA has assigned option codes to:
OPTION_IA_PD (25)
OPTION_IAPREFIX (26)
from the option-code space as defined in section 24.3, "DHCP Options"
of RFC 3315.
IANA has assigned status code 6 to:
NoPrefixAvail: Delegating router has no prefixes available to
assign to the IAPD(s)
from the status-code space as defined in section 24.4, "Status Codes"
of RFC 3315.
17. Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; neither does it represent that it
has made any effort to identify any such rights. Information on the
IETF’s procedures with respect to rights in standards-track and
standards-related documentation can be found in BCP-11. Copies of
claims of rights made available for publication and any assurances of
licenses to be made available, or the result of an attempt made to
obtain a general license or permission for the use of such
proprietary rights by implementors or users of this specification can
be obtained from the IETF Secretariat.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights which may cover technology that may be required to practice
this standard. Please address the information to the IETF Executive
Director.
18. References
18.1. Normative References
[1] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6)
Specification", RFC 2460, December 1998.
[2] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C. and M.
Carney, "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)",
RFC 3315, July 2003.
[3] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[4] Narten, T., Nordmark, E. and W. Simpson, "Neighbor Discovery for
IP Version 6 (IPv6)", RFC 2461, December 1998.
[5] Aboba, B., Zorn, G. and D. Mitton, "RADIUS and IPv6", RFC 3162,
August 2001.
18.2. Informative References
[6] Miyakawa, S. and R. Droms, "Requirements for IPv6 prefix
delegation", Work in Progress, August 2003.
19. Acknowledgements
Thanks for the input and review by (in alphabetical order) Steve
Deering, Dave Forster, Brian Haberman, Tatuya Jinmei, Shin Miyakawa,
Pekka Savola, Bernie Volz, Trevor Warwick and Toshi Yamasaki.
20. Authors’ Addresses
Ole Troan
Cisco Systems
250 Longwater Avenue
Reading RG2 6GB
United Kingdom
Phone: +44 20 8824 8666
EMail: ot@cisco.com
Ralph Droms
Cisco Systems
1414 Massachusetts Avenue
Boxborough, MA 01719
USA
Phone: +1 978 936 1674
EMail: rdroms@cisco.com
21. Full Copyright Statement
Copyright (C) The Internet Society (2003). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assignees.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.