Address Resolution Protocol (ARP) Mediation for IP Interworking of Layer 2 VPNs
Extracted elements (25)
IPv4 ARP and Inverse ARP are not IP packets and therefore cannot be carried on an IP pseudowire, requiring explicit LDP signaling of IPv4 addresses between PEs. IPv6 uses ICMPv6-based ND/IND which are IP packets and can traverse the IP pseudowire in-band, eliminating the need for separate IPv6 address signaling.
To avoid a deadlock in Frame Relay deployments (where CE sends Inverse ARP only after DLCI activation, but DLCI activation requires the PE to have received the remote CE IPv4 address), PEs advertise the PW FEC with an all-zeros IPv4 address first, then re-advertise once the CE address is learned.
IS-IS cannot be supported in IP L2 Interworking L2VPNs because IS-IS does not encapsulate its PDUs in IP, making them unable to traverse an IP pseudowire. OSPF over Ethernet CEs cross-connected to point-to-point CEs requires configuring ospfIfType to treat the broadcast link as point-to-point to avoid DR/BDR election issues and LSA type mismatches.
A Neighbor Solicitation or Advertisement received on an AC from a local CE MUST be forwarded over the pseudowire unmodified. When received over the PW, if a source link-layer address option is present, the PE MUST remove it before forwarding to the local CE.
A PE MUST be prepared to advertise the PW FEC before the IPv4 address of the CE is known by using an IPv4 address value of zero. When the CE IPv4 address becomes available, the PE re-advertises the PW FEC with the actual address. If the address becomes invalid, the PE MUST re-advertise with a null IP address.
A PE performing ARP Mediation for IPv4 MUST: discover the local CE IP address, terminate (not forward) ARP/Inverse ARP requests locally, distribute the IP address to the remote PE via PW control signaling, notify the local CE of the remote CE IP, and respond to ARP/Inverse ARP using the remote CE IP and local PE hardware address.
A PE performing ARP Mediation for IPv6 MUST intercept ND and IND packets from both the AC and PW, learn the IPv6 configuration from them, forward them (possibly modified) to the appropriate destination, and generate interworking packets to bridge between ND and IND.
A PE supporting IPv6 MUST be capable of intercepting ICMPv6 ND and IND packets over both AC and PW, recording IPv6 interface and link-layer addresses, possibly modifying packets per egress AC type, and forwarding them toward the original destination.
A PE that supports IPv6 on an IP PW MUST signal the Stack Capability Interface Parameter sub-TLV in the initial Label Mapping message. Both PEs compare advertised values and use only capabilities supported by both.
All implementations MUST support manual configuration of the IPv4 address of the local CE. Manual configuration is the only REQUIRED mode for a PE to support; all other IPv4 address discovery mechanisms (traffic monitoring, ARP, Inverse ARP, PPP, Router Discovery) are optional.
If an IP packet arrives at the ingress PE with multiple data link headers (e.g., bridged Ethernet PDU on ATM AC), all data link headers MUST be removed before transmission over the pseudowire.
If the local AC does not support IND, the PE MUST discard a received INA and generate a Neighbor Advertisement toward its local CE, using the source IPv6 address from the INA and the link-layer address of the local AC.
In stack capability fallback mode, the PE MUST send a Label Withdraw with status 0x0000004B ('Wrong IP Address Type') followed by a Label Mapping without the Stack Capability sub-TLV. A PE receiving a Label Withdraw with this status MUST NOT respond with a Label Release and MUST wait for the next control message.
In the PW operational-down-on-mismatch mode, if a PE supporting IPv6 has already sent a Label Mapping and does not receive a matching Stack Capability sub-TLV from the far-end, it MUST withdraw its PW label with LDP status code 0x0000004A ('IP Address Type Mismatch').
When an AC type is PPP, other NCPs with the exception of CCP and ECP MUST be rejected during IPCP negotiation between the PE and local CE. The PE performs proxy PPP negotiation, not end-to-end between CEs.
When the local CE generates an ARP request, the PE MUST proxy the ARP response using its own MAC address as the source hardware address and the remote CE IP as the source protocol address, and MUST respond only to ARP requests whose destination protocol address matches the remote CE IP.
A new Pseudowire Interface Parameters sub-TLV assigned Parameter ID 0x16 ('Stack Capability'). A new 'L2VPN PE Stack Capabilities' registry created as a 16-bit field; Bit 0 (0x0001) is IPv6 stack capability; remaining bits assigned by IANA via IETF Review.
Three new LDP Status Codes assigned from the 'Status Code Name Space' registry: 0x0000002C ('IP Address of CE'), 0x0000004A ('IP Address Type Mismatch'), and 0x0000004B ('Wrong IP Address Type').
Data traffic between CE and PE is unencrypted. To prevent MAC address spoofing on Ethernet ACs, the local PE may verify source MAC addresses; when spoofing is detected, the PE MUST sever the CE connection, tear down the PW, and restart the address resolution process.
SEND (RFC 3971) is incompatible with IPv6 ARP Mediation because PEs must modify Neighbor Discovery packets. PEs MUST remove all SEND packet options from ND packets before forwarding into the pseudowire. CE devices MUST be configured to accept non-SEND packets, and IPv6 ARP Mediation SHOULD only be used with physically secure Attachment Circuits.
The LDP connection between PEs MUST be secured by verifying the incoming connection against the configured peer address and authenticating LDP messages per RFC 5036 Section 2.9. During ARP/Inverse ARP processing, the PE MUST verify received IP and MAC address information against local configuration before forwarding to the remote PE, to protect against CE connection hijacking.
An IP Layer 2 Interworking Circuit enters monitoring state immediately after configuration. In this state it performs CE IP discovery and PW establishment in parallel. Unicast IP frames are only propagated between AC and PW once CE IP devices on both sides are discovered and proxy functions are complete; before that, only broadcast/multicast frames are forwarded and unicast datagrams are dropped.
The IP Address List TLV used to signal CE IPv4 addresses in the LDP Label Mapping message has a Length of 6 (2-byte Address Family field set to 1 for IPv4, and 4-byte Addresses field containing a single IPv4 address). An all-zeros address indicates the PE has not yet learned the CE IPv4 address.
The LDP Notification message for CE IP address updates includes a Status TLV with status code 0x0000002C ('IP address of CE'), an IP Address List TLV, and a PWid or Generalized ID FEC. The Message ID field is set to 0 as it does not refer to a specific message.
The Stack Capability Interface Parameter sub-TLV has Parameter ID 0x16, Length 4, and a 16-bit Stack Capability bit field. Bit 0 (bitmask 0x0001) indicates IPv6 Stack Capability; remaining bits (0x0002–0x8000) are unassigned and require IETF Review for allocation.