Generic Routing Encapsulation (GRE) Key Extension for Mobile IPv4
Extracted elements (20)
The FA is prohibited from modifying the 'G' bit in the Registration Request because it falls within the region protected by the Mobile-Home Authentication extension. Instead, the GRE Key Extension is placed outside the authenticated region, allowing the FA to request GRE encapsulation without invalidating the MN-HA authentication.
When the tuple <Care-of Address, Home Address, Home Agent Address> is identical across multiple subscriber sessions (e.g., in multi-VPN home networks with overlapping home addresses), IP-in-IP tunneling cannot distinguish individual sessions. GRE keying solves this by providing a per-session demultiplexing value exchanged during registration.
An FA may include a GRE key value of zero in the GRE Key Extension to signal that the HA should assign GRE keys in both directions. This allows HA-driven key assignment without requiring the FA to supply non-zero key values.
If the FA does not support GRE encapsulation, it MUST reset the 'G' bit in the Agent Advertisement and, if the MN requests GRE encapsulation, return an RRP with code 72 ('requested encapsulation unavailable').
If the HA receives a Registration Request with a GRE Key Extension but without the 'G' bit set, the HA SHOULD treat this as if the 'G' bit is set; i.e., the presence of a GRE Key Extension constitutes a request for GRE encapsulation.
If the HA receives the GRE Key Extension but does not recognize this non-skippable extension, it MUST silently discard the Registration Request message.
If the HA recognizes the GRE Key Extension but is not configured to support GRE encapsulation, it MUST send an RRP with code 139 ('requested encapsulation unavailable') per RFC 3024.
If the MN is capable of supporting GRE encapsulation, it SHOULD set the 'G' bit in the Flags field of the Registration Request per RFC 5944.
The FA MUST NOT modify the 'G' bit in the Registration Request because it is protected by the Mobile-Home Authentication extension. The GRE Key Extension is the mechanism to request GRE encapsulation without altering the authenticated field.
The FA MUST support IP-in-IP tunneling of datagrams for Mobile IPv4 as a baseline, and if capable of GRE encapsulation, should set the 'G' bit in the Agent Advertisement message sent to the MN.
The GRE Key Extension SHALL follow the RFC 5944 extension format and SHALL be added after MN-HA, MN-FA Challenge, and MN-AAA extensions (if any) and before the FA-HA Auth extension (if any).
When GRE encapsulation is allowed and applicable, the FA MUST include the GRE Key in the GRE Key Extension in all Mobile IP Registration Requests, including initial, renewal, and de-registration requests, before forwarding to the HA.
When local policy allows the FA to override the 'G' bit and the MN has not requested GRE tunneling and is not using a co-located care-of address, the FA MUST include the GRE Key Extension in the RRQ forwarded to the HA. The presence of this extension takes precedence over the 'G' bit setting.
When the HA accepts a Registration Request with the GRE Key Extension, it MUST assign a GRE key and include the GRE Key Extension in the RRP. It MUST include the GRE Key Extension in all RRPs in response to any RRQ that included the extension, when a GRE key is available.
When the HA receives a GRE Key Extension carrying a GRE key value of zero in the initial Registration Request, it MUST assign GRE keys for both directions and include them in the GRE Key Extension in the RRP sent to the FA.
GRE tunneling for Mobile IPv4 supports asymmetric GRE keying: the FA assigns a GRE key for traffic it sends (used by the HA in encapsulating GRE headers for reverse tunneling), and the HA assigns its own GRE key (used by the FA in encapsulating GRE headers). Keys are exchanged during the Mobile IP registration procedure.
The GRE Key Extension is a new Mobile IP extension (Type 48, non-skippable) used by a Foreign Agent to supply a GRE key and associated information to the Home Agent in order to establish a GRE tunnel between the FA and the HA. It conforms to the Mobile IPv4 extension format specified in RFC 5944.
IANA assigned Type value 48 for the GRE Key Extension from the Mobile IP non-skippable extension range (0-127). The extension also introduces a Sub-Type numbering space (0-255); value 0 is assigned, and new sub-type values require Expert Review with Specification Required.
This specification introduces no new security considerations beyond those in RFC 5944. The GRE Key is not a cryptographic secret; despite the name, it is a demultiplexing index used to distinguish packets belonging to a given flow within a GRE tunnel, not a shared secret requiring protection.
The GRE Key Extension carries a Type field (8-bit, value 48), a Sub-Type field (8-bit, value 0), a Length field (value 4), and a Key Identifier field (32-bit / 4 octets) inserted in every GRE packet of user traffic. Total encoded length is 8 octets including Type, Sub-Type, and Length.