Internet Engineering Task Force M.M. Mawatari
Internet-Draft Japan Internet Exchange Co.,Ltd.
Intended status: Best Current Practice M.K. Kawashima
Expires: July 26, 2013 NEC AccessTechnica, Ltd.
C.B. Byrne
T-Mobile USA
January 22, 2013

464XLAT: Combination of Stateful and Stateless Translation


This document describes an architecture (464XLAT) for providing limited IPv4 connectivity across an IPv6-only network by combining existing and well-known stateful protocol translation RFC 6146 in the core and stateless protocol translation RFC 6145 at the edge. 464XLAT is a simple and scalable technique to quickly deploy limited IPv4 access service to IPv6-only edge networks without encapsulation.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http:/⁠/⁠⁠drafts/⁠current/⁠.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on July 26, 2013.

Copyright Notice

Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http:/⁠/⁠⁠license-⁠info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

1. Introduction

With the exhaustion of the unallocated IPv4 address pools, it will be difficult for many networks to assign IPv4 addresses to end users.

This document describes an IPv4 over IPv6 solution as one of the techniques for IPv4 service extension and encouragement of IPv6 deployment. 464XLAT is not a one-for-one replacement of full IPv4 functionality. The 464XLAT architecture only supports IPv4 in the client server model, where the server has a global IPv4 address. This means it is not fit for IPv4 peer-to-peer communication or inbound IPv4 connections. 464XLAT builds on IPv6 transport and includes full any-to-any IPv6 communication.

The 464XLAT architecture described in this document uses IPv4/IPv6 translation standardized in [RFC6145] and [RFC6146]. It does not require DNS64 [RFC6147] since an IPv4 host may simply send IPv4 packets, including packets to an IPv4 DNS server, which will be translated on the customer side translator (CLAT) to IPv6 and back to IPv4 on the provider side translator (PLAT). 464XLAT networks may use DNS64 [RFC6147] to enable single stateful translation [RFC6146] instead of 464XLAT double translation where possible. The 464XLAT architecture encourages the IPv6 transition by making IPv4 services reachable across IPv6-only networks and providing IPv6 and IPv4 connectivity to single-stack IPv4 or IPv6 servers and peers.

2. BCP Scenario

This document describes one way to deploy an IPv6-only access network, built on a 464XLAT architecture. Likely motivations for running an IPv6-only access network include the fact that IPv6-only single protocol operation is less complex and IPv4 addresses are scarce. Providing an IPv6-only network involves either tunneling or translation. This document describes how to build one type of solution based on translation. What is described herein has been implemented and shown to work well, and is the best current practice for building a service based on 464XLAT architecture.

This BCP only applies when the following three criteria are present:

There is an IPv6-only network that uses stateful translation [RFC6146] as the only mechanism for providing IPv4 access.
There are IPv4-only applications or hosts that must communicate across the IPv6-only network to reach the IPv4 Internet.
Existing business or technical artifacts preclude the use of a tunnel based IPv6 transition mechanism.

3. Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].

4. Terminology

PLAT is Provider side translator(XLAT) that complies with [RFC6146]. It translates N:1 global IPv6 addresses to global IPv4 addresses, and vice versa.
CLAT is Customer side translator(XLAT) that complies with [RFC6145]. It algorithmically translates 1:1 private IPv4 addresses to global IPv6 addresses, and vice versa. The CLAT function is applicable to a router or an end-node such as a mobile phone. The CLAT SHOULD perform IP routing and forwarding to facilitate packets forwarding through the stateless translation even if it is an end-node. The CLAT as a common home router or wireless Third Generation Partnership Project (3GPP) router is expected to perform gateway functions such as DHCP server and DNS proxy for local clients. The CLAT uses different IPv6 prefixes for CLAT-side and PLAT-side IPv4 addresses and therefore does not comply with the sentence "Both IPv4-translatable IPv6 addresses and IPv4-converted IPv6 addresses SHOULD use the same prefix." in Section 3.3 of [RFC6052]. The CLAT does not facilitate communications between a local IPv4-only node and an IPv6-only node on the Internet.

5. Motivation and Uniqueness of 464XLAT

Minimal IPv4 resource requirements, maximum IPv4 efficiency through statistical multiplexing.
No new protocols required, quick deployment.
IPv6-only networks are simpler and therefore less expensive to operate than dual-stack networks.
Consistent native IP based monitoring, traffic engineering, and capacity planning techniques can be applied without the indirection or obfuscation of a tunnel.

6. Network Architecture

Examples of 464XLAT architectures are shown in the figures in the following sections.

Wireline Network Architecture can fit in the situations where there are clients behind the CLAT in the same way regardless of the type of access service, for example FTTH, DOCSIS, or WiFi.

Wireless 3GPP Network Architecture fits in the situations where a client terminates the wireless access network and may act as a router with tethered clients.

6.1. Wireline Network Architecture

The private IPv4 host on this diagram can reach global IPv4 hosts via translation on both CLAT and PLAT. On the other hand, the IPv6 host can reach other IPv6 hosts on the Internet directly without translation. This means that the CPE/CLAT can not only have the function of a CLAT but also the function of an IPv6 native router for native IPv6 traffic. The v4p host behind the CLAT on this diagram has [RFC1918] addresses.

                              |  v6  |
                              | host |
                            /         \
                           /   IPv6    \
                          |  Internet   |
                           \           /
+------+   |                 .---+---.                    .------.
|  v6  +---+   +------+     /         \     +------+     /        \
| host |   |   |      |    /   IPv6    \    |      |    /   IPv4   \
+------+   +---+ CLAT +---+   Network   +---+ PLAT +---+  Internet  |
+--------+ |   |      |    \           /    |      |    \           /
| v4p/v6 +-+   +------+     `---------'     +------+     `----+----'
|  host  | |                                                  |
+--------+ |                                               +--+---+
+------+   |                                               | v4g  |
| v4p  +---+                                               | host |
| host |   |                                               +------+
+------+   |

       <- v4p -> XLAT <--------- v6 --------> XLAT <- v4g ->

  v6  : Global IPv6
  v4p : Private IPv4
  v4g : Global IPv4

Figure 1: Wireline Network Topology

6.2. Wireless 3GPP Network Architecture

The CLAT function on the User Equipment (UE) provides an [RFC1918] address and IPv4 default route to the local node network stack. The applications on the UE can use the private IPv4 address for reaching global IPv4 hosts via translation on both the CLAT and the PLAT. On the other hand, reaching IPv6 hosts (including host presented via DNS64 [RFC6147]) does not require the CLAT function on the UE.

Presenting a private IPv4 network for tethering via NAT44 and stateless translation on the UE is also an application of the CLAT.

                               |  v6  |
                               | host |
                             /         \
                            /   IPv6    \
                           |   Internet  |
                            \           /
   UE / Mobile Phone         `---------'
+----------------------+          |
| +----+    |          |      .---+---.                   .------.
| | v6 +----+   +------+     /         \     +------+    /        \
| +----+    |   |      |    / IPv6 PDP  \    |      |   /   IPv4   \
|           +---+ CLAT +---+ Mobile Core +---+ PLAT +--+  Internet  |
|           |   |      |    \    GGSN   /    |      |   \          /
|           |   +------+     \         '     +------+    `----+---'
| +-----+   |          |      `-------'                       |
| | v4p +---+          |                                   +--+---+
| +-----+   |          |                                   | v4g  |
+----------------------+                                   | host |

        <- v4p -> XLAT <--------- v6 --------> XLAT <- v4g ->

  v6   : Global IPv6
  v4p  : Private IPv4
  v4g  : Global IPv4
  PDP  : Packet Data Protocol
  GGSN : Gateway GPRS Support Node

Figure 2: Wireless 3GPP Network Topology

7. Applicability

7.1. Wireline Network Applicability

When an Internet Service Provider (ISP) has IPv6 access service and provides 464XLAT, the ISP can provide outgoing IPv4 service to end users across an IPv6 access network. The result is that edge network growth is no longer tightly coupled to the availability of scarce IPv4 addresses.

If another ISP operates the PLAT, the edge ISP is only required to deploy an IPv6 access network. All ISPs do not need IPv4 access networks. They can migrate their access network to a simple and highly scalable IPv6-only environment.

7.2. Wireless 3GPP Network Applicability

At the time of writing, in January 2013, the vast majority of mobile networks are compliant to Pre-Release 9 3GPP standards. In Pre-Release 9 3GPP networks, Global System for Mobile Communications (GSM) and Universal Mobile Telecommunications System (UMTS) networks must signal and support both IPv4 and IPv6 Packet Data Protocol (PDP) attachments to access IPv4 and IPv6 network destinations [RFC6459]. Since there are two PDPs required to support two address families, this is double the number of PDPs required to support the status quo of one address family, which is IPv4.

For the cases of connecting to an IPv4 literal or IPv4 socket that require IPv4 connectivity, the CLAT function on the UE provides a private IPv4 address and IPv4 default route on the host for the applications to reference and bind to. Connections sourced from the IPv4 interface are immediately routed to the CLAT function and passed to the IPv6-only mobile network, destined for the PLAT. In summary, the UE has the CLAT function that does a stateless translation [RFC6145], but only when required by an IPv4-only scenario such as IPv4 literals or IPv4-only sockets. The mobile network has a PLAT that does stateful translation [RFC6146].

464XLAT works with today's existing systems as much as possible. 464XLAT is compatible with existing network based deep packet inspection solutions like 3GPP standardized Policy and Charging Control (PCC) [TS.23203].

8. Implementation Considerations

8.1. IPv6 Address Format

The IPv6 address format in 464XLAT is defined in Section 2.2 of [RFC6052].

8.2. IPv4/IPv6 Address Translation Chart

This chart offers an explanation about address translation architecture using a combination of stateful translation at the PLAT and stateless translation at the CLAT. The client on this chart is delegated an IPv6 prefix from a prefix delegation mechanism such as DHCPv6-PD [RFC3633], therefore it has a dedicated IPv6 prefix for translation.

                                        Destination IPv4 address
                                       | Global IPv4 address        |
                                       | assigned to IPv4 server    |
                            +--------+ +----------------------------+
                            |  IPv4  |  Source IPv4 address
                            | server | +----------------------------+
                            +--------+ | Global IPv4 address        |
                                ^      | assigned to IPv4 PLAT pool |
                                |      +----------------------------+
                            |  PLAT  | Stateful XLATE(IPv4:IPv6=1:n)
                           (IPv6 cloud)
      Destination IPv6 address
     | IPv4-Embedded IPv6 address                                   |
     | defined in Section 2.2 of RFC6052                            |
      Source IPv6 address
     | IPv4-Embedded IPv6 address                                   |
     | defined in Section 2.2 of RFC6052                            |
                           (IPv6 cloud)
                            |  CLAT  | Stateless XLATE(IPv4:IPv6=1:1)
                                ^       Destination IPv4 address
                                |      +----------------------------+
                            +--------+ | Global IPv4 address        |
                            |  IPv4  | | assigned to IPv4 server    |
                            | client | +----------------------------+
                            +--------+  Source IPv4 address
                                       | Private IPv4 address       |
                                       | assigned to IPv4 client    |

Case of enabling only stateless XLATE on CLAT

8.3. IPv6 Prefix Handling

There are two relevant IPv6 prefixes that the CLAT must be aware of.

First, CLAT must know its own IPv6 prefixes. The CLAT SHOULD acquire a /64 for the uplink interface, a /64 for all downlink interfaces, and a dedicated /64 prefix for the purpose of sending and receiving statelessly translated packets. When a dedicated /64 prefix is not available for translation from DHCPv6-PD [RFC3633], the CLAT MAY perform NAT44 for all IPv4 LAN packets so that all the LAN originated IPv4 packets appear from a single IPv4 address and are then statelessly translated to one interface IPv6 address that is claimed by the CLAT via NDP and defended with DAD.

Second, the CLAT MUST discover the PLAT-side translation IPv6 prefix used as a destination of the PLAT. The CLAT will use this prefix as the destination of all translation packets that require stateful translation to the IPv4 Internet. It MAY discover the PLAT-side translation prefix using [I-D.ietf-behave-nat64-discovery-heuristic]. In the future some other mechanisms, such as a new DHCPv6 option, will possibly be defined to communicate the PLAT-side translation prefix.

8.4. DNS Proxy Implementation

The CLAT SHOULD implement a DNS proxy as defined in [RFC5625]. The case of an IPv4-only node behind the CLAT querying an IPv4 DNS server is undesirable since it requires both stateful and stateless translation for each DNS lookup. The CLAT SHOULD set itself as the DNS server via DHCP or other means and proxy DNS queries for IPv4 and IPv6 LAN clients. Using the CLAT enabled home router or UE as a DNS proxy is a normal consumer gateway function and simplifies the traffic flow so that only IPv6 native queries are made across the access network. DNS queries from the client that are not sent to the DNS proxy on the CLAT MUST be allowed and are translated and forwarded just like any other IP traffic.

8.5. CLAT in a Gateway

The CLAT feature can be implemented in a common home router or mobile phone that has a tethering feature. Routers with a CLAT feature SHOULD also provide common router services such as DHCP of [RFC1918] addresses, DHCPv6, NDP with RA, and DNS service.

8.6. CLAT to CLAT communications

464XLAT is a hub and spoke architecture focused on enabling IPv4-only services over IPv6-only networks. ICE [RFC5245] MAY be used to support peer-to-peer communication within a 464XLAT network.

9. Deployment Considerations

9.1. Traffic Engineering

Even if the ISP for end users is different from the PLAT provider (e.g. another ISP), it can implement traffic engineering independently from the PLAT provider. Detailed reasons are below:

The ISP for end users can figure out IPv4 destination address from translated IPv6 packet header, so it can implement traffic engineering based on IPv4 destination address (e.g. traffic monitoring for each IPv4 destination address, packet filtering for each IPv4 destination address, etc.). The tunneling methods do not have such an advantage, without any deep packet inspection for processing the inner IPv4 packet of the tunnel packet.
If the ISP for end users can assign an IPv6 prefix greater than /64 to each subscriber, this 464XLAT architecture can separate IPv6 prefix for native IPv6 packets and the XLAT prefixes for IPv4/IPv6 translation packets. Accordingly, it can identify the type of packets ("native IPv6 packets" and "IPv4/IPv6 translation packets"), and implement traffic engineering based on the IPv6 prefix.

9.2. Traffic Treatment Scenarios

The below table outlines how different permutations of connectivity are treated in the 464XLAT architecture.

NOTE: 464XLAT double translation treatment will be stateless when a dedicated /64 is available for translation on the CLAT. Otherwise, the CLAT will have both stateful and stateless since it requires NAT44 from the LAN to a single IPv4 address and then stateless translation to a single IPv6 address.

  | Server | Application |   Traffic Treatment   | Location of |
  |        | and Host    |                       | Translation |
  |  IPv6  |    IPv6     |    End-to-end IPv6    |    None     |
  |  IPv4  |    IPv6     | Stateful Translation  |    PLAT     |
  |  IPv4  |    IPv4     |        464XLAT        |  PLAT/CLAT  |

Traffic Treatment Scenarios

10. Security Considerations

To implement a PLAT, see security considerations presented in Section 5 of [RFC6146].

To implement a CLAT, see security considerations presented in Section 7 of [RFC6145]. The CLAT MAY comply with [RFC6092].

11. IANA Considerations

This document has no actions for IANA.

12. Acknowledgements

The authors would like to thank JPIX NOC members, JPIX 464XLAT trial service members, Seiichi Kawamura, Dan Drown, Brian Carpenter, Rajiv Asati, Washam Fan, Behcet Sarikaya, Jan Zorz, Tatsuya Oishi, Lorenzo Colitti, Erik Kline, Ole Troan, Maoke Chen, Gang Chen, Tom Petch, Jouni Korhonen, Bjoern A. Zeeb, Hemant Singh, Vizdal Ales, Mark ZZZ Smith, Mikael Abrahamsson, Tore Anderson, Teemu Savolainen, Alexandru Petrescu, Gert Doering, Victor Kuarsingh, Ray Hunter, James Woodyatt, and Tom Taylor for their helpful comments. Special acknowledgments go to Remi Despres for his plentiful supports and suggestions, especially about using NAT44 with IANA's EUI-64 ID. We also would like to thank Fred Baker and Joel Jaeggli for their support.

13. References

13.1. Normative References

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC6052] Bao, C., Huitema, C., Bagnulo, M., Boucadair, M. and X. Li, "IPv6 Addressing of IPv4/IPv6 Translators", RFC 6052, October 2010.
[RFC6145] Li, X., Bao, C. and F. Baker, "IP/ICMP Translation Algorithm", RFC 6145, April 2011.
[RFC6146] Bagnulo, M., Matthews, P. and I. van Beijnum, "Stateful NAT64: Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers", RFC 6146, April 2011.

13.2. Informative References

[RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G. and E. Lear, "Address Allocation for Private Internets", BCP 5, RFC 1918, February 1996.
[RFC3633] Troan, O. and R. Droms, "IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6", RFC 3633, December 2003.
[RFC5245] Rosenberg, J., "Interactive Connectivity Establishment (ICE): A Protocol for Network Address Translator (NAT) Traversal for Offer/Answer Protocols", RFC 5245, April 2010.
[RFC5625] Bellis, R., "DNS Proxy Implementation Guidelines", BCP 152, RFC 5625, August 2009.
[RFC6092] Woodyatt, J., "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service", RFC 6092, January 2011.
[RFC6147] Bagnulo, M., Sullivan, A., Matthews, P. and I. van Beijnum, "DNS64: DNS Extensions for Network Address Translation from IPv6 Clients to IPv4 Servers", RFC 6147, April 2011.
[RFC6459] Korhonen, J., Soininen, J., Patil, B., Savolainen, T., Bajko, G. and K. Iisakkila, "IPv6 in 3rd Generation Partnership Project (3GPP) Evolved Packet System (EPS)", RFC 6459, January 2012.
[I-D.ietf-behave-nat64-discovery-heuristic] Savolainen, T, Korhonen, J and D Wing, "Discovery of a Network-Specific NAT64 Prefix using a Well-Known Name", Internet-Draft draft-ietf-behave-nat64-discovery-heuristic-05, January 2012.
[TS.23203] 3GPP, "Policy and charging control architecture", 3GPP TS 23.203 10.7.0, June 2012.

Appendix A. Examples of IPv4/IPv6 Address Translation

The following is a example of IPv4/IPv6 Address Translation on the 464XLAT architecture.

In the case that an IPv6 prefix greater than /64 is assigned to an end user by such as DHCPv6-PD [RFC3633], the CLAT can use a dedicated /64 from the assigned IPv6 prefix.

   Host & configuration value
|           IPv4 server        |
|         []       |            IP packet header
+------------------------------+   +--------------------------------+
                ^                  | Destination IP address         |
                |                  | []                 |
                |                  | Source IP address              |
                |                  | []                    |
+------------------------------+   +--------------------------------+
|              PLAT            |                   ^
| IPv4 pool address            |                   |
| [ -]    |                   |
| PLAT-side XLATE IPv6 prefix  |                   |
| [2001:db8:1234::/96]         |                   |
+------------------------------+   +--------------------------------+
                ^                  | Destination IP address         |
                |                  | [2001:db8:1234::]  |
                |                  | Source IP address              |
                |                  | [2001:db8:aaaa::]   |
+------------------------------+   +--------------------------------+
|              CLAT            |                   ^
| PLAT-side XLATE IPv6 prefix  |                   |
| [2001:db8:1234::/96]         |                   |
| CLAT-side XLATE IPv6 prefix  |                   |
| [2001:db8:aaaa::/96]         |                   |
+------------------------------+   +--------------------------------+
                ^                  | Destination IP address         |
                |                  | []                 |
                |                  | Source IP address              |
                |                  | []                  |
+------------------------------+   +--------------------------------+
|          IPv4 client         |
|        []      |
Delegated IPv6 prefix for client: 2001:db8:aaaa::/56


Authors' Addresses

Masataka Mawatari Japan Internet Exchange Co.,Ltd. KDDI Otemachi Building 19F, 1-8-1 Otemachi, Chiyoda-ku, Tokyo 100-0004 JAPAN Phone: +81 3 3243 9579 EMail:
Masanobu Kawashima NEC AccessTechnica, Ltd. 800, Shimomata Kakegawa-shi, Shizuoka 436-8501 JAPAN Phone: +81 537 23 9655 EMail:
Cameron Byrne T-Mobile USA Bellevue, Washington, 98006 USA EMail: