Attribute-Value Pairs for Provisioning Customer Equipment Supporting IPv4-Over-IPv6 Transitional Solutions
Extracted elements (29)
A Grouped AVP wrapper is unnecessary for DS-Lite because AAA only needs to supply the AFTR's FQDN; the absence of lw4o6 or MAP-E Grouped AVPs with only the AFTR FQDN present implicitly signals DS-Lite as the selected transition method.
Border routers are identified by FQDN rather than IP address, following the precedent of RFC 6334 and RFC 6519 for DS-Lite. The FQDN can be dereferenced to one or more IP addresses by the provisioning system or passed as-is to the customer equipment, providing flexibility.
The Tunnel-Source-Pref-Or-Addr AVP is defined separately from Lw4o6-Binding to allow flexibility: the provisioning system can deliver just the tunnel source address to AAA independently, while still supporting delivery of the complete binding to the lw4o6 border router.
For lw4o6, per-subscriber configuration at the CPE (IPv4 address, port set, tunnel source address) must be synchronized with corresponding configuration at the border router. The border router requires the same public IPv4 address and port set parameters bound to the full /128 tunnel source IPv6 address.
The B4 interface IPv4 address for DS-Lite (valid range 192.0.0.2–192.0.0.7, default 192.0.0.2) is not provisioned via AAA in this framework because it is problematic when multiple B4 instances share a device; it is determined by implementation-dependent or static means.
All AVPs defined in this document have the V-flag in the MUST NOT column, meaning the Vendor-ID flag must not be set. The M-bit usage for these AVPs in a given command may be defined by the application per RFC 6733.
The 64-Multicast-Attributes AVP MUST include at least one of ASM-mPrefix64 or SSM-mPrefix64, and MAY include both. When SSM-mPrefix64 is present, the Delegated-IPv6-Prefix AVP MUST also be present.
The Lw4o6-External-IPv4-Addr AVP (code 641) AddressType field MUST be set to 1 (IPv4) and the total length of the AVP MUST be 14 octets.
The Tunnel-Source-IPv6-Address AVP (code 638) is of type Address and its AddressType field MUST be set to 2 (IPv6); it conveys the CPE's local tunnel endpoint address for an lw4o6 tunnel.
The Tunnel-Source-Pref-Or-Addr AVP MUST contain either the Delegated-IPv6-Prefix AVP or the Tunnel-Source-IPv6-Address AVP, but not both.
Within ASM-mPrefix64 and SSM-mPrefix64 AVPs, the AddressType field of IP-Address MUST have value 2 (IPv6), the conveyed prefix MUST belong to the correct multicast range, and unused bits beyond the prefix MUST be set to zeroes by the sender.
Within MAP-E-Attributes, at least one Border-Router-Name AVP MUST be present and at least one MAP-Mapping-Rule AVP MUST be present. In Hub-and-Spoke mode, additional MAP-Mapping-Rule instances MUST NOT be present.
Within MAP-Mapping-Rule, the Rule-IPv4-Addr-Or-Prefix, Rule-IPv6-Prefix, EA-Field-Length, and Port-Set-Identifier AVPs MUST all be present.
Within the 64-Multicast-Attributes AVP, the Delegated-IPv6-Prefix AVP used as uPrefix64 MUST have a Prefix-Length value of one of 32, 48, 56, 64, or 96, per RFC 6052 address mapping guidelines.
The AVPs defined in this document reveal privacy-sensitive information such as subscriber addresses that can be used for tracking. All these AVPs are considered security-sensitive, and the security considerations of RFC 6733 Section 13.3 MUST be followed for Diameter messages containing them.
The 64-Multicast-Attributes AVP (code 634) is a Grouped AVP carrying IPv6 multicast prefixes for IPv4-over-IPv6 multicast delivery (DS-Lite, MAP-E, lw4o6). It contains optional ASM-mPrefix64, SSM-mPrefix64, and Delegated-IPv6-Prefix (as uPrefix64) sub-AVPs.
The ASM-mPrefix64 AVP (code 635) is a Grouped AVP containing an IP-Address (AddressType MUST be 2/IPv6, MUST belong to ASM range) and IP-Prefix-Length (valid range 24–96) for synthesizing IPv4-embedded IPv6 multicast group addresses in ASM mode.
The Border-Router-Name AVP (code 633) is of type OctetString and carries the FQDN of a DS-Lite AFTR, lw4o6 border router, or MAP-E border relay. FQDN encoding MUST follow RFC 1035/1123/2181 syntax in ASCII; A-labels (RFC 5891) must be used for internationalized domain names.
The EA-Field-Length AVP (code 647) is of type Unsigned32 with valid values 0–48, encoding the number of Embedded Address bits in the MAP-E end-user IPv6 prefix used to derive IPv4 address and port number configuration per RFC 7597 Section 5.2.
The IP-Prefix-Length AVP (code 632) is of type Unsigned32 and provides the length of an IPv4 or IPv6 prefix; valid values are 0–32 for IPv4 and 0–128 for IPv6. It is only meaningful when associated with an IP-Address AVP inside a Grouped AVP.
The Lw4o6-Binding AVP (code 640) is a Grouped AVP binding an lw4o6 tunnel to IPv4 packets; it contains mandatory Tunnel-Source-Pref-Or-Addr and Lw4o6-External-IPv4-Addr sub-AVPs, and an optional Port-Set-Identifier when the IPv4 address is shared.
The MAP-E-Attributes AVP (code 642) is a Grouped AVP carrying all MAP-E configuration for a single MAP domain: one or more Border-Router-Name AVPs, one or more MAP-Mapping-Rule AVPs, an optional MAP-Mesh-Mode AVP, and an optional Delegated-IPv6-Prefix for the end-user IPv6 prefix.
The MAP-Mapping-Rule AVP (code 644) is a Grouped AVP requiring all four sub-AVPs: Rule-IPv4-Addr-Or-Prefix, Rule-IPv6-Prefix, EA-Field-Length, and Port-Set-Identifier. It encodes a MAP-E Basic or Forwarding Mapping Rule.
The MAP-Mesh-Mode AVP (code 643) is of type Enumerated with values 0 (MESH) and 1 (HUB_AND_SPOKE). The absence of this AVP indicates Hub-and-Spoke mode is required.
The SSM-mPrefix64 AVP (code 636) is a Grouped AVP containing an IP-Address (IPv6, SSM range) and IP-Prefix-Length for synthesizing IPv4-embedded IPv6 multicast group addresses in Source-Specific Multicast mode.
The Tunnel-Source-Pref-Or-Addr AVP (code 637) is a Grouped AVP that carries either the IPv6 Binding Prefix (Delegated-IPv6-Prefix) or the full tunnel source IPv6 address (Tunnel-Source-IPv6-Address) for lw4o6 CPE configuration; it MUST contain exactly one of the two, not both.
IANA registered 16 new Diameter AVP codes (632–647) in the 'AVP Codes' registry for IPv4-over-IPv6 transitional provisioning, covering IP-Prefix-Length, Border-Router-Name, multicast attributes, tunnel source, port set, lw4o6 binding, and MAP-E attributes.
MITM attacks on the Diameter delivery path can cause denial-of-service via misconfiguration (invalid addresses leading to connectivity failure or traffic interception via a fake border node). Diameter security is currently hop-by-hop only (RFC 6733 Section 2.2) with no end-to-end security solution, leaving intermediate Diameter peers able to tamper with AVP contents.
The Port-Set-Identifier AVP (code 639) is a structured OctetString of exactly 4 octets (total AVP length 12): Offset (8-bit unsigned, values 0–15), PSIDLength (8-bit unsigned, values 0 to 16-a), and PSIDValue (16-bit, PSID right-justified in low-order k bits). A PSIDLength of 0 means no PSID.