IPv6 Rapid Deployment on IPv4 Infrastructures (6rd) -- Protocol Specification
Extracted elements (32)
6rd allows embedding fewer than the full 32 IPv4 bits when the SP's IPv4 address block is well-aggregated (e.g., private 10/8 requires only 24 bits), saving IPv6 prefix space and allowing larger delegated prefixes to customer sites.
6rd is stateless, allowing BRs to be reached via anycast for failover and resiliency (similar to RFC 3068 for 6to4). Stateless operation enables any BR to serve any CE at any time without session synchronization.
6rd uses the SP's own IPv6 prefix rather than the well-known 6to4 2002::/16 prefix, limiting the operational domain to the SP network under its direct control and making the IPv6 service equivalent to native IPv6 from the perspective of customer sites and the IPv6 Internet.
6rd addresses assigned from 6rd delegated prefixes should be treated as native IPv6 with no changes to source or destination address selection policy tables (RFC 3484).
6rd utilizes the same IPv6-in-IPv4 encapsulation mechanism as 6to4 (RFC 3056/RFC 4213). 6to4 routes with the 2002::/16 prefix may coexist with 6rd in a CE router and may offer efficiencies when communicating directly with 6to4 routers.
A BR using an anycast source address MUST set the IPv4 Don't Fragment flag to prevent incorrect reassembly when multiple BRs send fragmented packets with possibly identical fragment IDs to the same CE.
A CE MUST support at least one BR IPv4 address and MAY support more than one when multiple BR IPv4 addresses are present in the DHCP option.
A CE that needs to determine BR reachability MUST utilize a method that allows reachability detection packets to follow a typical data forwarding path without special processing by the BR.
Absent more specific information, the 6rd Tunnel MTU SHOULD default to 1280 bytes.
Bits in the 6rdPrefix after the 6rdPrefixLen number of bits are reserved and MUST be initialized to zero by the sender and ignored by the receiver.
By default, the CE router MUST drop packets received on the 6rd virtual interface for IPv6 destinations not within its own 6rd delegated prefix.
By default, the IPv6 Traffic Class field MUST be copied to the IPv4 ToS (Type of Service) field during encapsulation. This default behavior MAY be overridden by configuration.
If a 6rd prefix requires the full 32-bit IPv4 address and non-aggregatable IPv4 space is used, the 6rd prefix MUST be no longer than /32 in order to offer a 6rd delegated prefix of at least /64.
If the BR IPv4 address is anycast, the relay MUST use this anycast IPv4 address as the source address in packets relayed to CEs.
On successful receipt of a NUD probe packet at the BR, the BR MUST decapsulate and forward the packet normally so it loops back to the originating CE.
Prefix lifetimes advertised in Router Advertisements or used by DHCP on the CE LAN side MUST be equal to or shorter than the IPv4 address lease time. If the IPv4 lease time is unknown, the lifetime SHOULD follow the defaults specified in RFC 4861.
Sending NUD or any periodic packets between 6rd CE devices beyond isolated troubleshooting is NOT RECOMMENDED due to scalability concerns in large deployments.
The 6rd BR and CE MUST validate that the embedded IPv4 source address of the encapsulated IPv6 packet matches the IPv4 source address of the encapsulating packet per the configured 6rd domain parameters. If they do not match, the packet MUST be dropped.
The 6rd delegated prefix SHOULD be /64 or shorter to allow for stateless address auto-configuration on the CE LAN side.
The BR and CE MUST be configured with the same four 6rd elements (IPv4MaskLen, 6rdPrefix, 6rdPrefixLen, 6rdBRIPv4Address) for a given 6rd domain.
The BR MUST install a null route (RFC 4632) for its 6rd delegated prefix created based on its BR IPv4 address, with the exception of the IPv6 Subnet-Router anycast address.
The CE IPv4 address MUST be configured to send and receive packets on the CE WAN side interface.
The CE MUST be able to configure the 6rd mechanism to be disabled, in which case the 6rd DHCP option, if received, is silently ignored.
The CE MUST include a Parameter Request List Option (RFC 2132) for the OPTION_6RD. A CE that allows IPv4 configuration by DHCP SHOULD implement the 6rd DHCP option.
The sum of (32 - IPv4MaskLen) + 6rdPrefixLen MUST be less than or equal to 128, ensuring the 6rd delegated prefix fits within 128-bit IPv6 address space.
A 6rd domain consists of 6rd Customer Edge (CE) routers and one or more 6rd Border Relays (BRs). The 6rd delegated prefix is created by concatenating the 6rd prefix and a consecutive set of bits from the CE IPv4 address, with length equal to the 6rd prefix length (n) plus the number of IPv4 bits used (o).
Four 6rd configuration elements are required for all CEs and BRs in a domain: IPv4MaskLen (0-32, number of common high-order IPv4 bits), 6rdPrefix (the SP's IPv6 prefix), 6rdPrefixLen, and 6rdBRIPv4Address. These values are identical across all nodes in a given 6rd domain.
IANA assigned DHCP option code 212 (OPTION_6RD) with a data length of 18 + N octets, where N/4 is the number of 6rd BR IPv4 addresses.
A malicious user aware of a 6rd domain and BR IPv4 address can construct packets causing a BR to reflect tunneled packets outside its domain, potentially creating forwarding loops between 6rd domains and enabling packet amplification attacks. Mitigations include restricting BR IPv4 address reachability to within the SP's 6rd domain and installing null routes for the BR's 6rd delegated prefix.
By restricting the 6rd domain to within a provider network, a CE only needs to accept packets from a known set of 6rd BR IPv4 addresses, avoiding many open-relay threats that apply to 6to4 (RFC 3964). The receiving rules in Section 9.2 provide anti-spoofing protection equivalent to native IPv4.
A 6rd IPv6 address embeds the 6rd prefix (n bits), a consecutive portion of the CE IPv4 address (o bits), a subnet ID (m bits), and an interface ID (128-n-o-m bits). The 6rd delegated prefix spans the first n+o bits.
The 6rd DHCPv4 option (OPTION_6RD, code 212) carries: 1-octet OPTION_6RD code, 1-octet option-length, 1-octet IPv4MaskLen, 1-octet 6rdPrefixLen, 16-octet 6rdPrefix, and one or more 4-octet 6rdBRIPv4Address fields. Minimum length is 22 octets with one BR address.