Port Control Protocol (PCP) Anycast Addresses
Extracted elements (15)
Anycast addresses are particularly useful in larger topologies where the PCP-enabled NAT/firewall is not on the client's default gateway (e.g., Carrier-Grade NAT). With dynamic routing protocols like OSPF, DHCP-based discovery may not be feasible, while anycast lets PCP requests travel like any other packet without special support from DNS, DHCP, or other infrastructure.
PCP authentication [RFC7652] is most suitable for scenarios with many users and a trusted network operator (large corporate or campus networks with parallel NATs/firewalls), but less suitable for high-trust small scenarios (residential gateways) or low-trust environments (airport Wi-Fi) where the setup cost outweighs benefits. A thorough cost-benefit analysis per scenario is recommended.
Using an anycast address instead of a DHCP option allows the anycast address to be hard-coded into the application, eliminating the need for an API to pass the PCP server address from the OS DHCP client to the application.
If a routing change causes a PCP client to start interacting with a different PCP server, the client can detect this by examining the Epoch field during the next PCP response or ANNOUNCE message, then re-establish firewall rules. This is equivalent to a PCP server reboot from the client's perspective.
In topologies with multiple parallel firewalls each controlled by its own PCP server, only one server will receive messages from a given client based on routing table state. If routing is asymmetric (upstream and downstream packets traverse different firewalls), establishing rules via anycast in only one firewall will not enable bidirectional connectivity.
PCP anycast allows a client to communicate only with its closest upstream PCP server, but may be used in conjunction with the PCP proxy function [RFC7648] to support scenarios with cascaded PCP-enabled NATs or firewalls.
A means to disable or override the well-known anycast addresses (e.g., a configuration file option) should be available in implementations.
PCP clients can add the PCP anycast addresses after the default router list (for IPv4 and IPv6) to the list of PCP servers, processed as specified in RFC 7488.
PCP servers can be configured to listen on the anycast addresses for incoming PCP requests. When a PCP server receives a PCP request destined for an anycast address it supports, it MUST send the corresponding PCP replies using that same anycast address as the source address.
PCP anycast addresses provide a mechanism for PCP clients to reach their closest PCP-aware on-path NAT, firewall, or other middlebox without requiring external configuration of the middlebox's IP address. Two well-known addresses are established: one IPv4 (192.0.0.9/32) and one IPv6 (2001:1::1/128).
IANA registered IPv4 address 192.0.0.9/32 in the 'IANA IPv4 Special-Purpose Address Registry' as 'Port Control Protocol Anycast', allocated October 2015, with Source=True, Destination=True, Forwardable=True, Global=True.
IANA registered IPv6 address 2001:1::1/128 in the 'IANA IPv6 Special-Purpose Address Registry' as 'Port Control Protocol Anycast', allocated October 2015, with Source=True, Destination=True, Forwardable=True, Global=True.
In networks without a PCP-anycast-aware border gateway, NAT, or firewall, outgoing PCP requests could leak onto the external Internet and reveal information about internal devices. Border gateways should block such packets; in the default-free zone, routers should drop them, naturally achieved via BGP messages advertising no route to the anycast address.
PCP anycast messages can be hijacked in the first network segment by impersonating the default router (e.g., ARP spoofing) or further in the core network by injecting counterfeited routing protocol messages (OSPF/BGP). PCP authentication [RFC7652] may be useful in some scenarios, but its setup cost conflicts with the goal of fully automatic configuration via anycast.
Sensitive PCP clients can set an IP TTL on their PCP requests to limit how far they travel toward the public Internet, preventing information leakage about internal devices. Additionally, clients can send a parameterless ANNOUNCE request first to probe whether a PCP server is present at the anycast address before sending privacy-sensitive requests.