idnits 2.17.1 draft-ietf-netlmm-proxymip6-13.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** It looks like you're using RFC 3978 boilerplate. You should update this to the boilerplate described in the IETF Trust License Policy document (see https://trustee.ietf.org/license-info), which is required now. -- Found old boilerplate from RFC 3978, Section 5.1 on line 21. -- Found old boilerplate from RFC 3978, Section 5.5, updated by RFC 4748 on line 3849. -- Found old boilerplate from RFC 3979, Section 5, paragraph 1 on line 3860. -- Found old boilerplate from RFC 3979, Section 5, paragraph 2 on line 3867. -- Found old boilerplate from RFC 3979, Section 5, paragraph 3 on line 3873. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust Copyright Line does not match the current year -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (May 12, 2008) is 5825 days in the past. Is this intentional? -- Found something which looks like a code comment -- if you have code sections in the document, please surround them with '' and '' lines. Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'P1' is mentioned on line 2754, but not defined == Missing Reference: 'P2' is mentioned on line 2754, but not defined == Missing Reference: 'Pn' is mentioned on line 2755, but not defined == Missing Reference: 'P5' is mentioned on line 2755, but not defined == Missing Reference: 'P6' is mentioned on line 2755, but not defined == Missing Reference: 'P7' is mentioned on line 2755, but not defined == Missing Reference: 'P8' is mentioned on line 2755, but not defined == Missing Reference: 'Pm-1' is mentioned on line 2755, but not defined == Missing Reference: 'Pm' is mentioned on line 2755, but not defined == Unused Reference: 'RFC-1661' is defined on line 3677, but no explicit reference was found in the text ** Obsolete normative reference: RFC 3315 (Obsoleted by RFC 8415) ** Obsolete normative reference: RFC 3775 (Obsoleted by RFC 6275) ** Obsolete normative reference: RFC 4140 (Obsoleted by RFC 5380) ** Obsolete normative reference: RFC 4282 (Obsoleted by RFC 7542) -- Obsolete informational reference (is this intentional?): RFC 1981 (Obsoleted by RFC 8201) -- Obsolete informational reference (is this intentional?): RFC 3588 (Obsoleted by RFC 6733) -- Obsolete informational reference (is this intentional?): RFC 4306 (Obsoleted by RFC 5996) -- Obsolete informational reference (is this intentional?): RFC 4330 (Obsoleted by RFC 5905) -- Obsolete informational reference (is this intentional?): RFC 4941 (Obsoleted by RFC 8981) == Outdated reference: A later version (-18) exists of draft-ietf-netlmm-pmip6-ipv4-support-02 == Outdated reference: A later version (-09) exists of draft-ietf-dna-protocol-07 Summary: 5 errors (**), 0 flaws (~~), 13 warnings (==), 13 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 NETLMM WG S. Gundavelli (Editor) 3 Internet-Draft K. Leung 4 Intended status: Standards Track Cisco 5 Expires: November 13, 2008 V. Devarapalli 6 Wichorus 7 K. Chowdhury 8 Starent Networks 9 B. Patil 10 Nokia Siemens Networks 11 May 12, 2008 13 Proxy Mobile IPv6 14 draft-ietf-netlmm-proxymip6-13.txt 16 Status of this Memo 18 By submitting this Internet-Draft, each author represents that any 19 applicable patent or other IPR claims of which he or she is aware 20 have been or will be disclosed, and any of which he or she becomes 21 aware will be disclosed, in accordance with Section 6 of BCP 79. 23 Internet-Drafts are working documents of the Internet Engineering 24 Task Force (IETF), its areas, and its working groups. Note that 25 other groups may also distribute working documents as Internet- 26 Drafts. 28 Internet-Drafts are draft documents valid for a maximum of six months 29 and may be updated, replaced, or obsoleted by other documents at any 30 time. It is inappropriate to use Internet-Drafts as reference 31 material or to cite them other than as "work in progress." 33 The list of current Internet-Drafts can be accessed at 34 http://www.ietf.org/ietf/1id-abstracts.txt. 36 The list of Internet-Draft Shadow Directories can be accessed at 37 http://www.ietf.org/shadow.html. 39 This Internet-Draft will expire on November 13, 2008. 41 Copyright Notice 43 Copyright (C) The IETF Trust (2008). 45 Abstract 47 Network-based mobility management enables IP mobility for a host 48 without requiring its participation in any mobility related 49 signaling. The Network is responsible for managing IP mobility on 50 behalf of the host. The mobility entities in the network are 51 responsible for tracking the movements of the host and initiating the 52 required mobility signaling on its behalf. This specification 53 describes a network-based mobility management protocol and is 54 referred to as Proxy Mobile IPv6. 56 Table of Contents 58 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 59 2. Conventions & Terminology . . . . . . . . . . . . . . . . . . 4 60 2.1. Conventions used in this document . . . . . . . . . . . . 5 61 2.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 5 62 3. Proxy Mobile IPv6 Protocol Overview . . . . . . . . . . . . . 9 63 4. Proxy Mobile IPv6 Protocol Security . . . . . . . . . . . . . 15 64 4.1. Peer Authorization Database (PAD) Example Entries . . . . 16 65 4.2. Security Policy Database (SPD) Example Entries . . . . . . 17 66 5. Local Mobility Anchor Operation . . . . . . . . . . . . . . . 17 67 5.1. Extensions to Binding Cache Entry Data Structure . . . . . 18 68 5.2. Supported Home Network Prefix Models . . . . . . . . . . . 19 69 5.3. Signaling Considerations . . . . . . . . . . . . . . . . . 20 70 5.3.1. Processing Binding Registrations . . . . . . . . . . . 20 71 5.3.2. Initial Binding Registration (New Mobility Session) . 22 72 5.3.3. Binding Lifetime Extension (No handoff) . . . . . . . 23 73 5.3.4. Binding Lifetime Extension (After handoff) . . . . . . 24 74 5.3.5. Binding De-Registration . . . . . . . . . . . . . . . 24 75 5.3.6. Constructing the Proxy Binding Acknowledgement 76 Message . . . . . . . . . . . . . . . . . . . . . . . 25 77 5.4. Multihoming Support . . . . . . . . . . . . . . . . . . . 27 78 5.4.1. Binding Cache entry lookup considerations . . . . . . 28 79 5.5. Timestamp Option for Message Ordering . . . . . . . . . . 33 80 5.6. Routing Considerations . . . . . . . . . . . . . . . . . . 36 81 5.6.1. Bi-Directional Tunnel Management . . . . . . . . . . . 36 82 5.6.2. Forwarding Considerations . . . . . . . . . . . . . . 37 83 5.7. Local Mobility Anchor Address Discovery . . . . . . . . . 38 84 5.8. Mobile Prefix Discovery Considerations . . . . . . . . . . 39 85 5.9. Route Optimization Considerations . . . . . . . . . . . . 39 86 6. Mobile Access Gateway Operation . . . . . . . . . . . . . . . 39 87 6.1. Extensions to Binding Update List Entry Data Structure . . 40 88 6.2. Mobile Node's Policy Profile . . . . . . . . . . . . . . . 41 89 6.3. Supported Access Link Types . . . . . . . . . . . . . . . 42 90 6.4. Supported Address Configuration Modes . . . . . . . . . . 42 91 6.5. Access Authentication & Mobile Node Identification . . . . 43 92 6.6. Acquiring Mobile Node's Identifier . . . . . . . . . . . . 43 93 6.7. Home Network Emulation . . . . . . . . . . . . . . . . . . 44 94 6.8. Link-Local and Global Address Uniqueness . . . . . . . . . 44 95 6.9. Signaling Considerations . . . . . . . . . . . . . . . . . 45 96 6.9.1. Binding Registrations . . . . . . . . . . . . . . . . 45 97 6.9.2. Router Solicitation Messages . . . . . . . . . . . . . 54 98 6.9.3. Default-Router . . . . . . . . . . . . . . . . . . . . 54 99 6.9.4. Retransmissions and Rate Limiting . . . . . . . . . . 55 100 6.9.5. Path MTU Discovery . . . . . . . . . . . . . . . . . . 56 101 6.10. Routing Considerations . . . . . . . . . . . . . . . . . . 57 102 6.10.1. Transport Network . . . . . . . . . . . . . . . . . . 57 103 6.10.2. Tunneling & Encapsulation Modes . . . . . . . . . . . 57 104 6.10.3. Local Routing . . . . . . . . . . . . . . . . . . . . 58 105 6.10.4. Tunnel Management . . . . . . . . . . . . . . . . . . 59 106 6.10.5. Forwarding Rules . . . . . . . . . . . . . . . . . . . 59 107 6.11. Supporting DHCPv6 based Address Configuration on the 108 Access Link . . . . . . . . . . . . . . . . . . . . . . . 61 109 6.12. Home Network Prefix Renumbering . . . . . . . . . . . . . 62 110 6.13. Mobile Node Detachment Detection and Resource Cleanup . . 62 111 6.14. Allowing network access to other IPv6 nodes . . . . . . . 63 112 7. Mobile Node Operation . . . . . . . . . . . . . . . . . . . . 64 113 7.1. Moving into a Proxy Mobile IPv6 Domain . . . . . . . . . . 64 114 7.2. Roaming in the Proxy Mobile IPv6 Domain . . . . . . . . . 65 115 8. Message Formats . . . . . . . . . . . . . . . . . . . . . . . 65 116 8.1. Proxy Binding Update Message . . . . . . . . . . . . . . . 66 117 8.2. Proxy Binding Acknowledgement Message . . . . . . . . . . 67 118 8.3. Home Network Prefix Option . . . . . . . . . . . . . . . . 69 119 8.4. Handoff Indicator Option . . . . . . . . . . . . . . . . . 70 120 8.5. Access Technology Type Option . . . . . . . . . . . . . . 71 121 8.6. Mobile Node Link-layer Identifier Option . . . . . . . . . 73 122 8.7. Link-local Address Option . . . . . . . . . . . . . . . . 74 123 8.8. Timestamp Option . . . . . . . . . . . . . . . . . . . . . 75 124 8.9. Status Values . . . . . . . . . . . . . . . . . . . . . . 75 125 9. Protocol Configuration Variables . . . . . . . . . . . . . . . 77 126 9.1. Local Mobility Anchor - Configuration Variables . . . . . 77 127 9.2. Mobile Access Gateway - Configuration Variables . . . . . 78 128 9.3. Proxy Mobile IPv6 Domain - Configuration Variables . . . . 79 129 10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 79 130 11. Security Considerations . . . . . . . . . . . . . . . . . . . 80 131 12. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 81 132 13. References . . . . . . . . . . . . . . . . . . . . . . . . . . 81 133 13.1. Normative References . . . . . . . . . . . . . . . . . . . 81 134 13.2. Informative References . . . . . . . . . . . . . . . . . . 82 135 Appendix A. Proxy Mobile IPv6 interactions with AAA 136 Infrastructure . . . . . . . . . . . . . . . . . . . 83 137 Appendix B. Routing State . . . . . . . . . . . . . . . . . . . . 84 138 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 85 139 Intellectual Property and Copyright Statements . . . . . . . . . . 87 141 1. Introduction 143 IP mobility for IPv6 hosts is specified in Mobile IPv6 [RFC-3775]. 144 Mobile IPv6 requires client functionality in the IPv6 stack of a 145 mobile node. Exchange of signaling messages between the mobile node 146 and home agent enables the creation and maintenance of a binding 147 between the mobile node's home address and its care-of-address. 148 Mobility as specified in [RFC-3775] requires the IP host to send IP 149 mobility management signaling messages to the home agent, which is 150 located in the network. 152 Network-based mobility is another approach to solving the IP mobility 153 challenge. It is possible to support mobility for IPv6 nodes without 154 host involvement by extending Mobile IPv6 [RFC-3775] signaling 155 messages between a network node and a home agent. This approach to 156 supporting mobility does not require the mobile node to be involved 157 in the exchange of signaling messages between itself and the home 158 agent. A proxy mobility agent in the network performs the signaling 159 with the home agent and does the mobility management on behalf of the 160 mobile node attached to the network. Because of the use and 161 extension of Mobile IPv6 signaling and home agent functionality, this 162 protocol is referred to as Proxy Mobile IPv6 (PMIPv6). 164 Network deployments which are designed to support mobility would be 165 agnostic to the capability in the IPv6 stack of the nodes which it 166 serves. IP mobility for nodes which have mobile IP client 167 functionality in the IPv6 stack as well as those nodes which do not, 168 would be supported by enabling Proxy Mobile IPv6 protocol 169 functionality in the network. The advantages of developing a network 170 based mobility protocol based on Mobile IPv6 are: 172 o Reuse of home agent functionality and the messages/format used in 173 mobility signaling. Mobile IPv6 is a mature protocol with several 174 implementations that have undergone interoperability testing. 176 o A common home agent would serve as the mobility agent for all 177 types of IPv6 nodes. 179 The problem statement and the need for a network based mobility 180 protocol solution has been documented in [RFC-4830]. Proxy Mobile 181 IPv6 is a solution that addresses these issues and requirements. 183 2. Conventions & Terminology 184 2.1. Conventions used in this document 186 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 187 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 188 document are to be interpreted as described in RFC 2119 [RFC-2119]. 190 2.2. Terminology 192 All the general mobility related terms used in this document are to 193 be interpreted as defined in the Mobile IPv6 base specification [RFC- 194 3775]. 196 This document adopts the terms, Local Mobility Anchor (LMA) and 197 Mobile Access Gateway (MAG) from the NETLMM Goals document [RFC- 198 4831]. This document also provides the following context specific 199 explanation to the following terms used in this document. 201 Proxy Mobile IPv6 Domain (PMIPv6-Domain) 203 Proxy Mobile IPv6 domain refers to the network where the mobility 204 management of a mobile node is handled using the Proxy Mobile IPv6 205 protocol as defined in this specification. The Proxy Mobile IPv6 206 domain includes local mobility anchors and mobile access gateways 207 between which security associations can be set up and 208 authorization for sending Proxy Binding Updates on behalf of the 209 mobile nodes can be ensured. 211 Local Mobility Anchor (LMA) 213 Local Mobility Anchor is the home agent for the mobile node in a 214 Proxy Mobile IPv6 domain. It is the topological anchor point for 215 the mobile node's home network prefix(es) and is the entity that 216 manages the mobile node's binding state. The local mobility 217 anchor has the functional capabilities of a home agent as defined 218 in Mobile IPv6 base specification [RFC-3775] with the additional 219 capabilities required for supporting Proxy Mobile IPv6 protocol as 220 defined in this specification. 222 Mobile Access Gateway (MAG) 224 Mobile Access Gateway is a function that manages the mobility 225 related signaling for a mobile node that is attached to its access 226 link. It is responsible for tracking the mobile node's movements 227 to and from the access link and for signaling the mobile node's 228 local mobility anchor. 230 Mobile Node (MN) 232 Throughout this document, the term mobile node is used to refer to 233 an IP host or router whose mobility is managed by the network. 234 The mobile node may be an IPv4-only node, IPv6-only node or a 235 dual-stack node and is not required to participate in any IP 236 mobility related signaling for achieving mobility for an IP 237 address that is obtained in that Proxy Mobile IPv6 domain. 239 LMA Address (LMAA) 241 The global address that is configured on the interface of the 242 local mobility anchor and is the transport endpoint of the bi- 243 directional tunnel established between the local mobility anchor 244 and the mobile access gateway. This is the address to where the 245 mobile access gateway sends the Proxy Binding Update messages. 246 When supporting IPv4 traversal, i.e., when the network between the 247 local mobility anchor and the mobile access gateway is an IPv4 248 network, this address will be an IPv4 address and will be referred 249 to as IPv4-LMAA, as specified in [ID-IPV4-PMIP6]. 251 Proxy Care-of Address (Proxy-CoA) 253 Proxy-CoA is the global address configured on the interface of the 254 mobile access gateway and is the transport endpoint of the tunnel 255 between the local mobility anchor and the mobile access gateway. 256 The local mobility anchor views this address as the Care-of 257 Address of the mobile node and registers it in the Binding Cache 258 entry for that mobile node. When the transport network between 259 the mobile access gateway and the local mobility anchor is an IPv4 260 network and if the care-of address that is registered at the local 261 mobility anchor is an IPv4 address, the term, IPv4-Proxy-CoA is 262 used, as specified in [ID-IPV4-PMIP6]. 264 Mobile Node's Home Network Prefix (MN-HNP) 266 This is the prefix that is assigned to a given interface of a 267 mobile node and is always present in the Router Advertisement 268 messages that the mobile node receives on any of the access links 269 in that Proxy Mobile IPv6 domain. There can also be multiple home 270 network prefixes assigned to a given interface of a mobile node 271 and in which case all of those assigned prefixes will still be 272 managed as part of one mobility session. The mobile node 273 configures its interface with one or more addresses from its home 274 network prefix(es). If the mobile node connects to the Proxy 275 Mobile IPv6 domain through multiple interfaces, simultaneously, 276 each of the attached interfaces will be assigned a unique set of 277 home network prefixes and all the prefixes assigned to a given 278 interface of a mobile node will be managed under one mobility 279 session. Additionally, in some configurations the assigned prefix 280 can be of 128-bit prefix length. Ex: Home network prefixes P1, P2 281 assigned to interface I1 will be managed under one mobility 282 session and prefixes P3, P4, P5 assigned to interface I2 of the 283 mobile node will be managed under a different mobility session. 285 Mobile Node's Home Address (MN-HoA) 287 MN-HoA is an address from a mobile node's home network prefix. 288 The mobile node will be able to use this address as long as it is 289 attached to the access network that is in the scope of that Proxy 290 Mobile IPv6 domain. If the mobile node uses more than one address 291 from its home network prefix(es), any one of these addresses is 292 referred to as mobile node's home address. Unlike in Mobile IPv6 293 where the home agent is aware of the home address of the mobile 294 node, in Proxy Mobile IPv6, the mobility entities are only aware 295 of the mobile node's home network prefix(es) and are not always 296 aware of the exact address(es) that the mobile node configured on 297 its interface from its home network prefix(es). However, in some 298 configurations and based on the enabled address configuration 299 modes on the access link, the mobility entities in the network can 300 be certain about the exact address(es) configured by the mobile 301 node. 303 Mobile Node's Home Link 305 This is the link on which the mobile node obtained its Layer-3 306 address configuration for the attached interface after it moved 307 into that Proxy Mobile IPv6 domain. This is the link that 308 conceptually follows the mobile node. The network will ensure the 309 mobile node always sees this link with respect to the layer-3 310 network configuration, on any access link that it attaches to in 311 that Proxy Mobile IPv6 domain. 313 Multihomed Mobile Node 315 A mobile node that connects to the same Proxy Mobile IPv6 domain 316 through more than one interface and uses these interfaces 317 simultaneously is referred to as a multihomed mobile node. 319 Mobile Node Identifier (MN-Identifier) 321 The identity of a mobile node in the Proxy Mobile IPv6 domain. 322 This is the stable identifier of a mobile node that the mobility 323 entities in a Proxy Mobile IPv6 domain can always acquire and use 324 it for predictably identifying a mobile node. This is typically 325 an identifier such as Network Access Identifier (NAI) [RFC-4282] 326 or other identifier such as a Media Access Control (MAC) address. 328 Mobile Node Link-layer Identifier (MN-LL-Identifier) 330 An identifier that identifies the attached interface of a mobile 331 node. For those interfaces that have a link-layer identifier, 332 this identifier can be based on that. The link-layer identifier 333 in some cases is generated by the mobile node and conveyed to the 334 mobile access gateway. This identifier of the attached interface 335 must be stable as seen by any of the mobile access gateways in a 336 given Proxy Mobile IPv6 domain. In some other cases, there might 337 not be any link-layer identifier associated with the mobile node's 338 interface. 340 Policy Profile 342 Policy Profile is an abstract term for referring to a set of 343 configuration parameters that are configured for a given mobile 344 node. The mobility entities in the Proxy Mobile IPv6 domain 345 require access to these parameters for providing the mobility 346 management to a given mobile node. The specific details on how 347 the network entities obtain this policy profile is outside the 348 scope of this document. 350 Proxy Binding Update (PBU) 352 A binding registration request message sent by a mobile access 353 gateway to a mobile node's local mobility anchor for establishing 354 a binding between the mobile node's home network prefix(es) 355 assigned to a given interface of a mobile node and its current 356 care-of address (Proxy-CoA). 358 Proxy Binding Acknowledgement (PBA) 360 A binding registration reply message sent by a local mobility 361 anchor in response to a Proxy Binding Update request message that 362 it received from a mobile access gateway. 364 Per-MN-Prefix & Shared-Prefix Models 366 The term, Per-MN-Prefix model, is used to refer to an addressing 367 model where there is an unique network prefix assigned for each 368 node. The term, Shared-Prefix model, is used to refer to an 369 addressing model where the prefix is shared by more than one node. 370 This specification supports the Per-MN-Prefix model and does not 371 support the Shared-Prefix model. 373 ALL_ZERO & NON_ZERO 374 Protocol message fields initialized with value 0 in each byte of 375 the field. Ex: An 8-byte link-layer identifier field with the 376 value set to 0 in each of the 8 bytes, or an IPv6 address with the 377 value 0 in all of the 16 bytes. Conversely, the term NON_ZERO is 378 used to refer to any value other than an ALL_ZERO value. 380 3. Proxy Mobile IPv6 Protocol Overview 382 This specification describes a network-based mobility management 383 protocol. It is called Proxy Mobile IPv6 and is based on Mobile IPv6 384 [RFC-3775]. 386 Proxy Mobile IPv6 protocol is intended for providing network-based IP 387 mobility management support to a mobile node, without requiring the 388 participation of the mobile node in any IP mobility related 389 signaling. The mobility entities in the network will track the 390 mobile node's movements and will initiate the mobility signaling and 391 set up the required routing state. 393 The core functional entities in the NETLMM infrastructure are the 394 Local Mobility Anchor (LMA) and the Mobile Access Gateway (MAG). The 395 local mobility anchor is responsible for maintaining the mobile 396 node's reachability state and is the topological anchor point for the 397 mobile node's home network prefix(es). The mobile access gateway is 398 the entity that performs the mobility management on behalf of a 399 mobile node and it resides on the access link where the mobile node 400 is anchored. The mobile access gateway is responsible for detecting 401 the mobile node's movements to and from the access link and for 402 initiating binding registrations to the mobile node's local mobility 403 anchor. The architecture of a Proxy Mobile IPv6 domain is shown in 404 Figure 1. 406 +----+ +----+ 407 |LMA1| |LMA2| 408 +----+ +----+ 409 LMAA1 -> | | <-- LMAA2 410 | | 411 \\ //\\ 412 \\ // \\ 413 \\ // \\ 414 +---\\------------- //------\\----+ 415 ( \\ IPv4/IPv6 // \\ ) 416 ( \\ Network // \\ ) 417 +------\\--------//------------\\-+ 418 \\ // \\ 419 \\ // \\ 420 \\ // \\ 421 Proxy-CoA1--> | | <-- Proxy-CoA2 422 +----+ +----+ 423 |MAG1|-----{MN2} |MAG2| 424 +----+ | +----+ 425 | | | 426 MN-HNP1 --> | MN-HNP2 | <-- MN-HNP3, MN-HNP4 427 {MN1} {MN3} 429 Figure 1: Proxy Mobile IPv6 Domain 431 Once a mobile node enters a Proxy Mobile IPv6 domain and attaches to 432 an access link, the mobile access gateway on that access link, after 433 identifying the mobile node and acquiring its identity, will 434 determine if the mobile node is authorized for the network-based 435 mobility management service. 437 If the network determines that the network-based mobility management 438 service needs to be offered to that mobile node, the network will 439 ensure that the mobile node using any of the address configuration 440 mechanisms permitted by the network will be able to obtain the 441 address configuration on the connected interface and move anywhere in 442 that Proxy Mobile IPv6 domain. The obtained address configuration 443 includes the address(es) from its home network prefix(es), the 444 default-router address on the link and other related configuration 445 parameters. From the perspective of the mobile node, the entire 446 Proxy Mobile IPv6 domain appears as a single link, the network 447 ensures that the mobile node believes it is always on the same link 448 where it obtained its initial address configuration, even after 449 changing its point of attachment in that network. 451 The mobile node may be an IPv4-only node, IPv6-only node or a dual 452 IPv4/IPv6 node. Based on what is enabled in the network for that 453 mobile node, the mobile node will be able to obtain an IPv4, IPv6 or 454 dual IPv4/IPv6 addresses and move anywhere in that Proxy Mobile IPv6 455 domain. However this specification only supports IPv6 address 456 mobility and when the transport network is IPv6 network. The support 457 for IPv4 addressing or IPv4 transport network is specified in the 458 companion document [ID-IPV4-PMIP6]. 460 If the mobile node connects to the Proxy Mobile IPv6 domain through 461 multiple interfaces and over multiple access networks, the network 462 will allocate a unique set of home network prefixes for each of the 463 connected interfaces. The mobile node will be able to configure 464 address(es) on those interfaces from the respective home network 465 prefix(es). However, if the mobile node performs an inter-interface 466 handoff by moving its address configuration from one interface to the 467 other and if the local mobility anchor receives a handoff hint from 468 the serving mobile access gateway about the same, the local mobility 469 anchor will assign the same home network prefix(es) that it 470 previously assigned prior to the handoff. The mobile node will also 471 be able to perform an handoff by changing its point of attachment 472 from one mobile access gateway to a different mobile access gateway 473 using the same interface and will be able to retain the address 474 configuration on the attached interface. 476 +-----+ +-----+ +-----+ 477 | MN | | MAG | | LMA | 478 +-----+ +-----+ +-----+ 479 | | | 480 MN Attached | | 481 | | | 482 | MN Attached Event from MN/Network | 483 | (Acquire MN-Id and Profile) | 484 | | | 485 |--- Rtr Sol --------->| | 486 | | | 487 | |--- PBU ------------->| 488 | | | 489 | | Accept PBU 490 | | (Allocate MN-HNP(s), Setup BCE and Tunnel) 491 | | | 492 | |<------------- PBA ---| 493 | | | 494 | Accept PBA | 495 | (Setup Tunnel and Routing) | 496 | | | 497 | |==== Bi-Dir Tunnel ===| 498 | | | 499 |<--------- Rtr Adv ---| | 500 | | | 501 IP Address | | 502 Configuration | | 503 | | | 505 Figure 2: Mobile Node Attachment - Signaling Call Flow 507 Figure 2 shows the signaling call flow when the mobile node enters 508 the Proxy Mobile IPv6 domain. The Router Solicitation message from 509 the mobile node may arrive at any time after the mobile node's 510 attachment and has no strict ordering relation with the other 511 messages in the call flow. 513 For updating the local mobility anchor about the current location of 514 the mobile node, the mobile access gateway sends a Proxy Binding 515 Update message to the mobile node's local mobility anchor. Upon 516 accepting this Proxy Binding Update message, the local mobility 517 anchor sends a Proxy Binding Acknowledgement message including the 518 mobile node's home network prefix(es). It also creates the Binding 519 Cache entry and sets up its endpoint of the bi-directional tunnel to 520 the mobile access gateway. 522 The mobile access gateway on receiving the Proxy Binding 523 Acknowledgement message sets up its endpoint of the bi-directional 524 tunnel to the local mobility anchor and also sets up the data path 525 for the mobile node's traffic. At this point the mobile access 526 gateway will have all the required information for emulating the 527 mobile node's home link. It sends Router Advertisement messages to 528 the mobile node on the access link advertising the mobile node's home 529 network prefix(es) as the hosted on-link-prefix(es). 531 The mobile node on receiving these Router Advertisement messages on 532 the access link will attempt to configure its interface either using 533 stateful or stateless address configuration modes, based on the modes 534 that are permitted on that access link. At the end of a successful 535 address configuration procedure, the mobile node will end up with one 536 or more addresses from its home network prefixes(es). 538 Once the address configuration is complete, the mobile node has one 539 or more valid addresses from its home network prefix(es) at the 540 current point of attachment. The serving mobile access gateway and 541 the local mobility anchor also have proper routing states for 542 handling the traffic sent to and from the mobile node using any one 543 or more of the addresses from its home network prefix(es). 545 The local mobility anchor, being the topological anchor point for the 546 mobile node's home network prefix(es), receives any packets that are 547 sent to the mobile node by any node in the network. The local 548 mobility anchor forwards these received packets to the mobile access 549 gateway through the bi-directional tunnel. The mobile access gateway 550 on other end of the tunnel, after receiving the packet, removes the 551 outer header and forwards the packet on the access link to the mobile 552 node. However, in some cases the traffic sent from a correspondent 553 node that is locally connected to the mobile access gateway may not 554 be received by the local mobility anchor and may be routed locally by 555 the mobile access gateway. 557 The mobile access gateway acts as the default router on the access 558 link. Any packet that the mobile node sends to any correspondent 559 node will be received by the mobile access gateway and will be sent 560 to its local mobility anchor through the bi-directional tunnel. The 561 local mobility anchor on the other end of the tunnel, after receiving 562 the packet, removes the outer header and routes the packet to the 563 destination. However in some cases the traffic sent to a 564 correspondent node that is locally connected to the mobile access 565 gateway may be locally routed by the mobile access gateway. 567 +-----+ +-----+ +-----+ +-----+ 568 | MN | |p-MAG| | LMA | |n-MAG| 569 +-----+ +-----+ +-----+ +-----+ 570 | | | | 571 | |==Bi-Dir Tunnel=| | 572 MN Detached | | | 573 | MN Detached Event | | 574 | | | | 575 | |-- DeReg PBU -->| | 576 | | | | 577 | | Accept PBU | 578 | | (Start MinDelayBeforeBCEDelete Timer) 579 | | | | 580 | |<-------- PBA --| | 581 | | | | 582 MN Attached | | | 583 | | | MN Attached event received 584 | | | from MN or from network 585 | | | (Acquire MN-Id and Profile) 586 | | | | 587 |--- Rtr Sol ------------------------------------->| 588 .... 589 Registration steps as in fig 2. 590 .... 591 | | |==Bi-Dir Tunnel=| 592 | | | | 593 |<------------------------------------ Rtr Adv ----| 594 | | | | 595 MN retains HoA/HNP(s) 596 | | | | 598 Figure 3: Mobile Node Handoff - Signaling Call Flow 600 Figure 3 shows the signaling call flow for the mobile node's handoff 601 from previously attached mobile access gateway (p-MAG) to the newly 602 attached mobile access gateway (n-MAG). This call flow reflects only 603 a specific message ordering, it is possible the registration message 604 from the n-MAG may arrive before the de-registration message from the 605 p-MAG arrives. 607 After obtaining the initial address configuration in the Proxy Mobile 608 IPv6 domain, if the mobile node changes its point of attachment, the 609 mobile access gateway on the previous link will detect the mobile 610 node's detachment from the link and will signal the local mobility 611 anchor and will remove the binding and routing state for that mobile 612 node. The local mobility anchor upon receiving this request will 613 identify the corresponding mobility session for which the binding 614 update request was received and once it accepts the request will wait 615 for certain amount of time for allowing the mobile access gateway on 616 the new link to update the binding. However, if it does not receive 617 any binding update request within that given amount of time, it will 618 delete the binding cache entry. 620 The mobile access gateway on the new access link upon detecting the 621 mobile node on its access link will signal the local mobility anchor 622 for updating the binding state. Once that signaling is complete, the 623 mobile node will continue to receive the Router Advertisements 624 containing its home network prefix(es) that were assigned to that 625 mobility session, making it believe it is still on the same link and 626 it will be able to use the same address configuration on the new 627 access link. 629 4. Proxy Mobile IPv6 Protocol Security 631 The signaling messages, Proxy Binding Update and Proxy Binding 632 Acknowledgement, exchanged between the mobile access gateway and the 633 local mobility anchor MUST be protected using end-to-end security 634 association(s) offering integrity and data origin authentication. 636 The mobile access gateway and the local mobility anchor MUST 637 implement IPsec for protecting the Proxy Mobile IPv6 signaling 638 messages [RFC-4301]. That is, IPsec is a mandatory to implement 639 security mechanism. However, additional documents may specify 640 alternative mechanisms and the mobility entities can enable a 641 specific mechanism for securing Proxy Mobile IPv6 signaling messages, 642 either based on a static configuration or after a dynamic negotiation 643 using any standard security negotiation protocols. As in Mobile IPv6 644 [RFC-3775], the use of IPsec for protecting mobile node's data 645 traffic is optional. 647 IPsec ESP [RFC-4303] in transport mode with mandatory integrity 648 protection SHOULD be used for protecting the signaling messages. 649 Confidentiality protection of these messages is not required. 651 IPsec ESP [RFC-4303] in tunnel mode MAY be used to protect the mobile 652 node's tunneled data traffic, if protection of data traffic is 653 required. 655 IKEv2 [RFC-4306] SHOULD be used to set up security associations 656 between the mobile access gateway and the local mobility anchor to 657 protect the Proxy Binding Update and Proxy Binding Acknowledgement 658 messages. The mobile access gateway and the local mobility anchor 659 can use any of the authentication mechanisms, as specified in [RFC- 660 4306], for mutual authentication. 662 The Mobile IPv6 specification [RFC-3775] requires the home agent to 663 prevent a mobile node from creating security associations or creating 664 binding cache entries for another mobile node's home address. In the 665 protocol described in this document, the mobile node is not involved 666 in creating security associations for protecting the signaling 667 messages or sending binding updates. Therefore, the local mobility 668 anchor MUST restrict the creation and manipulation of proxy bindings 669 to specifically authorized mobile access gateways and prefixes. The 670 local mobility anchor MUST be locally configurable to authorize such 671 specific combinations. Additional mechanisms such as a policy store 672 or AAA may be employed, but these are outside the scope of this 673 specification. 675 Unlike in Mobile IPv6 [RFC-3775], these signaling messages do not 676 carry either the Home Address destination option or the Type 2 677 Routing header and hence the policy entries and security association 678 selectors stay the same and require no special IPsec related 679 considerations. 681 4.1. Peer Authorization Database (PAD) Example Entries 683 This section describes PAD entries [RFC-4301] on the mobile access 684 gateway and the local mobility anchor. The PAD entries are only 685 example configurations. Note that the PAD is a logical concept and a 686 particular mobile access gateway or a local mobility anchor 687 implementation can implement the PAD in any implementation specific 688 manner. The PAD state may also be distributed across various 689 databases in a specific implementation. 691 mobile access gateway PAD: 692 - IF remote_identity = lma_identity_1 693 Then authenticate (shared secret/certificate/EAP) 694 and authorize CHILD_SA for remote address lma_address_1 696 local mobility anchor PAD: 697 - IF remote_identity = mag_identity_1 698 Then authenticate (shared secret/certificate/EAP) 699 and authorize CHILD_SAs for remote address mag_address_1 701 Figure 4: PAD Entries 703 The list of authentication mechanisms in the above examples is not 704 exhaustive. There could be other credentials used for authentication 705 stored in the PAD. 707 4.2. Security Policy Database (SPD) Example Entries 709 This section describes the security policy entries [RFC-4301] on the 710 mobile access gateway and the local mobility anchor required to 711 protect the Proxy Mobile IPv6 signaling messages. The SPD entries 712 are only example configurations. A particular mobile access gateway 713 or a local mobility anchor implementation could configure different 714 SPD entries as long as they provide the required security. 716 In the examples shown below, the identity of the mobile access 717 gateway is assumed to be mag_1, the address of the mobile access 718 gateway is assumed to be mag_address_1, and the address of the local 719 mobility anchor is assumed to be lma_address_1. 721 mobile access gateway SPD-S: 722 - IF local_address = mag_address_1 & 723 remote_address = lma_address_1 & 724 proto = MH & local_mh_type = BU & remote_mh_type = BA 725 Then use SA ESP transport mode 726 Initiate using IDi = mag_1 to address lma_address_1 728 local mobility anchor SPD-S: 729 - IF local_address = lma_address_1 & 730 remote_address = mag_address_1 & 731 proto = MH & local_mh_type = BA & remote_mh_type = BU 732 Then use SA ESP transport mode 734 Figure 5: SPD Entries 736 5. Local Mobility Anchor Operation 738 The local mobility anchor MUST support the home agent function as 739 defined in [RFC-3775] and additionally the extensions defined in this 740 specification. A home agent with these modifications and enhanced 741 capabilities for supporting the Proxy Mobile IPv6 protocol is 742 referred to as a local mobility anchor. 744 This section describes the operational details of the local mobility 745 anchor. 747 5.1. Extensions to Binding Cache Entry Data Structure 749 Every local mobility anchor MUST maintain a Binding Cache entry for 750 each currently registered mobile node. Binding Cache entry is a 751 conceptual data structure, described in Section 9.1 of [RFC-3775]. 753 For supporting this specification, the Binding Cache Entry data 754 structure needs to be extended with the following additional fields. 756 o A flag indicating whether or not this Binding Cache entry is 757 created due to a proxy registration. This flag is set to value 1 758 for Binding Cache entries that are proxy registrations and is set 759 to value 0 for all other entries. 761 o The identifier of the registered mobile node, MN-Identifier. This 762 identifier is obtained from the Mobile Node Identifier Option 763 [RFC-4283] present in the received Proxy Binding Update request. 765 o The link-layer identifier of the mobile node's connected interface 766 on the access link. This identifier can be acquired from the 767 Mobile Node Link-layer Identifier option, present in the received 768 Proxy Binding Update request. If the option was not present in 769 the request, the value MUST be set to ALL_ZERO. 771 o The link-local address of the mobile access gateway on the point- 772 to-point link shared with the mobile node. This is generated by 773 the local mobility anchor after accepting the initial Proxy 774 Binding Update request. 776 o List of IPv6 home network prefixes assigned to the mobile node's 777 connected interface. The home network prefix(es) may have been 778 statically configured in the mobile node's policy profile, or, 779 they may have been dynamically allocated by the local mobility 780 anchor. Each one of these prefix entries will also includes the 781 corresponding prefix length. 783 o The tunnel interface identifier (If-Id) of the bi-directional 784 tunnel between the local mobility anchor and the mobile access 785 gateway where the mobile node is currently anchored. This is 786 internal to the local mobility anchor. The tunnel interface 787 identifier is acquired during the tunnel creation. 789 o The access technology type, using which the mobile node is 790 currently attached. This is obtained from the Access Technology 791 Type option, present in the Proxy Binding Update request. 793 o The 64-bit timestamp value of the most recently accepted Proxy 794 Binding Update request sent for this mobile node. This is the 795 time-of-day on the local mobility anchor, when the message was 796 received. If the Timestamp option is not present in the Proxy 797 Binding Update request (i.e., when the sequence number based 798 scheme is in use), the value MUST be set to ALL_ZERO. 800 Typically, any one of the mobile node's home network prefixes from 801 its mobility session is the key for locating a Binding Cache entry in 802 all cases except when there has been an handoff of the mobile node's 803 session to a new mobile access gateway and that mobile access gateway 804 is unaware of the home network prefix(es) assigned to that mobility 805 session. In such handoff cases, the Binding Cache entry can be 806 located under the considerations specified in Section 5.4.1. 808 5.2. Supported Home Network Prefix Models 810 This specification supports the Per-MN-Prefix model and does not 811 support the Shared-Prefix model. As per the Per-MN-Prefix model, a 812 prefix assigned to a mobile node is for that mobile node's exclusive 813 use and no other node shares an address from that prefix (other than 814 the Subnet-Router anycast address [RFC-4291] which is used by the 815 mobile access gateway hosting that prefix on that link). 817 There may be more than one prefix assigned to a given interface of 818 the mobile node and all of those assigned prefixes are unique to that 819 mobile node and all are part of one mobility session. If the mobile 820 node attaches to the Proxy Mobile IPv6 domain through multiple 821 interfaces and simultaneously, each of the attached interfaces will 822 be assigned one or more unique prefixes and all of the assigned 823 prefixes to a given interface will be managed under a different 824 mobility session. 826 The mobile node's home network prefix(es) assigned to a given 827 interface of a mobile node (part of a mobility session) will be 828 hosted on the access link where the mobile node is attached (using 829 that interface). The local mobility anchor is not required to 830 perform any proxy ND operations [RFC-4861] for defending the mobile 831 node's home address(es), as the prefixes are not locally hosted on 832 the local mobility anchor. However, from the routing perspective, 833 the home network prefix(es) is topologically anchored on the local 834 mobility anchor. 836 5.3. Signaling Considerations 838 This section provides the rules for processing the signaling 839 messages. The processing rules specified in this section and other 840 related sections are chained and are in a specific order. When 841 applying these considerations for processing the signaling messages, 842 the specified order MUST be maintained. 844 5.3.1. Processing Binding Registrations 846 1. The received Proxy Binding Update message (a Binding Update 847 message with the 'P' flag set to value of 1, format specified in 848 Section 8.1) MUST be authenticated as described in Section 4. 849 When IPsec is used for message authentication, the SPI in the 850 IPsec header [RFC-4306] of the received packet is needed for 851 locating the security association, for authenticating the Proxy 852 Binding Update message. 854 2. The local mobility anchor MUST observe the rules described in 855 Section 9.2 of [RFC-3775] when processing Mobility Header in the 856 received Proxy Binding Update request. 858 3. The local mobility anchor MUST ignore the check, specified in 859 Section 10.3.1 of [RFC-3775], related to the presence of Home 860 Address destination option in the Proxy Binding Update request. 862 4. The local mobility anchor MUST identify the mobile node from the 863 identifier present in the Mobile Node Identifier option [RFC- 864 4283] of the Proxy Binding Update request. If the Mobile Node 865 Identifier option is not present in the Proxy Binding Update 866 request, the local mobility anchor MUST reject the request and 867 send a Proxy Binding Acknowledgement message with Status field 868 set to MISSING_MN_IDENTIFIER_OPTION (Missing mobile node 869 identifier option) and the identifier in the Mobile Node 870 Identifier Option carried in the message MUST be set to a zero 871 length identifier. 873 5. The local mobility anchor MUST apply the required policy checks, 874 as explained in Section 4, to verify the sender is a trusted 875 mobile access gateway, authorized to send Proxy Binding Update 876 requests on behalf of this mobile node. 878 6. If the local mobility anchor determines that the requesting node 879 is not authorized to send Proxy Binding Update requests for the 880 identified mobile node, it MUST reject the request and send a 881 Proxy Binding Acknowledgement message with Status field set to 882 MAG_NOT_AUTHORIZED_FOR_PROXY_REG (not authorized to send proxy 883 binding registrations). 885 7. If the local mobility anchor cannot identify the mobile node 886 based on the identifier present in the Mobile Node Identifier 887 option [RFC-4283] of Proxy Binding Update request, it MUST 888 reject the request and send a Proxy Binding Acknowledgement 889 message with Status field set to NOT_LMA_FOR_THIS_MOBILE_NODE 890 (Not local mobility anchor for this mobile node). 892 8. If the local mobility anchor determines that the mobile node is 893 not authorized for the network-based mobility management 894 service, it MUST reject the request and send a Proxy Binding 895 Acknowledgement message with Status field set to 896 PROXY_REG_NOT_ENABLED (Proxy Registration not enabled). 898 9. The local mobility anchor MUST apply the considerations 899 specified in Section 5.5, for processing the Sequence Number 900 field and the Timestamp option (if present), in the Proxy 901 Binding Update request. 903 10. If there is no Home Network Prefix option(s) (with any value) 904 present in the Proxy Binding Update request, the local mobility 905 anchor MUST reject the request and send a Proxy Binding 906 Acknowledgement message with Status field set to 907 MISSING_HOME_NETWORK_PREFIX_OPTION (Missing home network prefix 908 option). 910 11. If the Handoff Indicator option is not present in the Proxy 911 Binding Update request, the local mobility anchor MUST reject 912 the request and send a Proxy Binding Acknowledgement message 913 with Status field set to MISSING_HANDOFF_INDICATOR_OPTION 914 (Missing handoff indicator option). 916 12. If the Access Technology Type option is not present in the Proxy 917 Binding Update request, the local mobility anchor MUST reject 918 the request and send a Proxy Binding Acknowledgement message 919 with Status field set to MISSING_ACCESS_TECH_TYPE_OPTION 920 (Missing access technology type option). 922 13. Considerations specified in Section 5.4.1 MUST be applied for 923 performing the Binding Cache entry existence test. If those 924 checks specified in Section 5.4.1, result in associating the 925 received Proxy Binding Update request to a new mobility session 926 creation request, considerations from Section 5.3.2 (Initial 927 Binding Registration - New Mobility Session), MUST be applied. 928 If those checks result in associating the request to an existing 929 mobility session, the following checks determine the next set of 930 processing rules that needs to be applied. 932 * If the Handoff Indicator field in the Handoff Indicator 933 option present in the request is set to a value of 5 (Handoff 934 state not changed), considerations from Section 5.3.3 935 (Binding Lifetime Extension- No handoff) MUST be applied. 937 * If the received Proxy Binding Update request has the lifetime 938 value of zero, considerations from Section 5.3.5 (Binding De- 939 Registration) MUST be applied. 941 * For all other cases, considerations from Section 5.3.4 942 (Binding Lifetime Extension - After handoff) MUST be applied. 944 14. When sending the Proxy Binding Acknowledgement message with any 945 Status field value, the message MUST be constructed as specified 946 in Section 5.3.6. 948 5.3.2. Initial Binding Registration (New Mobility Session) 950 1. If there is at least one instance of Home Network Prefix option 951 present in the Proxy Binding Update request with the prefix value 952 set to ALL_ZERO, the local mobility anchor MUST allocate one or 953 more home network prefix(es) to the mobile node and assign it to 954 the new mobility session created for the mobile node. The local 955 mobility anchor MUST ensure the allocated prefix(es) is not in 956 use by any other node or mobility session. The decision on how 957 many prefixes to be allocated for the attached interface, can be 958 based on a global policy or a policy specific to that mobile 959 node. However, when stateful address autoconfiguration using 960 DHCPv6 is supported on the link, considerations from Section 6.11 961 MUST be applied for the prefix assignment. 963 2. If the local mobility anchor is unable to allocate any home 964 network prefix for the mobile node, it MUST reject the request 965 and send a Proxy Binding Acknowledgement message with Status 966 field set to 130 (Insufficient resources). 968 3. If there are one or more Home Network Prefix options present in 969 the Proxy Binding Update request (with each of the prefixes set 970 to a NON_ZERO value), the local mobility anchor before accepting 971 that request, MUST ensure each one of those prefixes is owned by 972 the local mobility anchor and further the mobile node is 973 authorized to use these prefixes. If the mobile node is not 974 authorized to use any one or more of those prefixes, the local 975 mobility anchor MUST reject the request and send a Proxy Binding 976 Acknowledgement message with Status field set to 977 NOT_AUTHORIZED_FOR_HOME_NETWORK_PREFIX (mobile node not 978 authorized for one or more of the requesting home network 979 prefixes). 981 4. Upon accepting the request, the local mobility anchor MUST create 982 a Binding Cache entry for the mobile node. It must set the 983 fields in the Binding Cache entry to the accepted values for that 984 registration. 986 5. If there is no existing bi-directional tunnel to the mobile 987 access gateway that sent the request, the local mobility anchor 988 MUST establish a bi-directional tunnel to that mobile access 989 gateway. Considerations from Section 5.6.1 MUST be applied for 990 managing the dynamically created bi-directional tunnel. 992 6. The local mobility anchor MUST create a prefix route(s) over the 993 tunnel to the mobile access gateway for forwarding any traffic 994 received for the mobile node's home network prefix(es) associated 995 with this mobility session. The created tunnel and the routing 996 state MUST result in the forwarding behavior on the local 997 mobility anchor as specified in Section 5.6.2. 999 7. The local mobility anchor MUST send the Proxy Binding 1000 Acknowledgement message with the Status field set to 0 (Proxy 1001 Binding Update Accepted). The message MUST be constructed as 1002 specified in Section 5.3.6. 1004 5.3.3. Binding Lifetime Extension (No handoff) 1006 1. Upon accepting the Proxy Binding Update request for extending the 1007 binding lifetime, received from the same mobile access gateway 1008 (if the Proxy-CoA address in the Binding Cache entry is the same 1009 as the Proxy-CoA address in the request) that last updated the 1010 binding, the local mobility anchor MUST update the Binding Cache 1011 entry with the accepted registration values. 1013 2. The local mobility anchor MUST send the Proxy Binding 1014 Acknowledgement message with the Status field set to 0 (Proxy 1015 Binding Update Accepted). The message MUST be constructed as 1016 specified in Section 5.3.6. 1018 5.3.4. Binding Lifetime Extension (After handoff) 1020 1. Upon accepting the Proxy Binding Update request for extending the 1021 binding lifetime, received from a new mobile access gateway (if 1022 the Proxy-CoA address in the Binding Cache entry does not match 1023 the Proxy-CoA address in the request) where the mobile node's 1024 session is handed off, the local mobility anchor MUST update the 1025 Binding Cache entry with the accepted registration values. 1027 2. The local mobility anchor MUST remove the previously created 1028 route(s) for the mobile node's home network prefix(es) associated 1029 with this mobility session. Additionally, if there are no other 1030 mobile node sessions sharing the dynamically created bi- 1031 directional tunnel to the previous mobile access gateway, the 1032 tunnel SHOULD be deleted applying considerations from section 1033 5.6.1 (if the tunnel is a dynamically created tunnel and not a 1034 fixed pre-established tunnel). 1036 3. If there is no existing bi-directional tunnel to the mobile 1037 access gateway that sent the request, the local mobility anchor 1038 MUST establish a bi-directional tunnel to that mobile access 1039 gateway. Considerations from Section 5.6.1 MUST be applied for 1040 managing the dynamically created bi-directional tunnel. 1042 4. The local mobility anchor MUST create prefix route(s) over the 1043 tunnel to the mobile access gateway for forwarding any traffic 1044 received for the mobile node's home network prefix(es) associated 1045 with that mobility session. The created tunnel and routing state 1046 MUST result in the forwarding behavior on the local mobility 1047 anchor as specified in Section 5.6.2. 1049 5. The local mobility anchor MUST send the Proxy Binding 1050 Acknowledgement message with the Status field set to 0 (Proxy 1051 Binding Update Accepted). The message MUST be constructed as 1052 specified in Section 5.3.6. 1054 5.3.5. Binding De-Registration 1056 1. If the received Proxy Binding Update request with the lifetime 1057 value of zero, has a Source Address in the IPv6 header (or the 1058 address in the Alternate Care-of Address option, if the option is 1059 present) different from what is present in the Proxy-CoA address 1060 field in the Binding Cache entry, the local mobility anchor MUST 1061 ignore the request. 1063 2. Upon accepting the Proxy Binding Update request with the lifetime 1064 value of zero, the local mobility anchor MUST wait for 1065 MinDelayBeforeBCEDelete amount of time, before it deletes the 1066 Binding Cache entry. However, it MUST send the Proxy Binding 1067 Acknowledgement message with the Status field set to 0 (Proxy 1068 Binding Update Accepted). The message MUST be constructed as 1069 specified in Section 5.3.6. 1071 * During this wait period, the local mobility anchor SHOULD drop 1072 the mobile node's data traffic. 1074 * During this wait period, if the local mobility anchor receives 1075 a valid Proxy Binding Update request for the same mobility 1076 session with the lifetime value of greater than zero, and if 1077 that request is accepted, then the Binding Cache entry MUST 1078 NOT be deleted, but must be updated with the newly accepted 1079 registration values and additionally the wait period should be 1080 ended. 1082 * By the end of this wait period, if the local mobility anchor 1083 did not receive any valid Proxy Binding Update request for 1084 this mobility session, then it MUST delete the Binding Cache 1085 entry and remove the routing state created for that mobility 1086 session. 1088 5.3.6. Constructing the Proxy Binding Acknowledgement Message 1090 o The local mobility anchor when sending the Proxy Binding 1091 Acknowledgement message to the mobile access gateway MUST 1092 construct the message as specified below. 1094 IPv6 header (src=LMAA, dst=Proxy-CoA) 1095 Mobility header 1096 - BA /* P flag must be set to value of 1 */ 1097 Mobility Options 1098 - Mobile Node Identifier Option (mandatory) 1099 - Home Network Prefix option(s) (mandatory) 1100 - Handoff Indicator option (mandatory) 1101 - Access Technology Type option (mandatory) 1102 - Timestamp Option (optional) 1103 - Mobile Node Link-layer Identifier option (optional) 1104 - Link-local Address option (optional) 1106 Figure 6: Proxy Binding Acknowledgement message format 1108 o The Source Address field in the IPv6 header of the message MUST be 1109 set to the destination address of the received Proxy Binding 1110 Update request. 1112 o The Destination Address field in the IPv6 header of the message 1113 MUST be set to the source address of the received Proxy Binding 1114 Update request. When there is no Alternate Care-of Address option 1115 present in the request, the destination address is the same as the 1116 Proxy-CoA address, otherwise, the address may not be the same as 1117 the Proxy-CoA. 1119 o The Mobile Node Identifier option [RFC-4283] MUST be present. The 1120 identifier field in the option MUST be copied from the Mobile Node 1121 Identifier option in the received Proxy Binding Update request. 1122 If the option was not present in the request, the identifier in 1123 the option MUST be set to a zero length identifier. 1125 o At least one Home Network Prefix option MUST be present. 1127 * If the Status field is set to a value greater than or equal to 1128 128, i.e., if the binding request is rejected, all the Home 1129 Network Prefix options that were present in the request (along 1130 with their prefix values) MUST be present in the reply. But, 1131 if there was no Home Network Prefix option present in the 1132 request, then there MUST be only one Home Network Prefix option 1133 and with the value in the option set to ALL_ZERO. 1135 * For all other cases, there MUST be a Home Network Prefix option 1136 for each of the assigned home network prefixes (for that 1137 mobility session) and with the prefix value in the option set 1138 to the allocated prefix value. 1140 o The Handoff Indicator option MUST be present. The handoff 1141 indicator field in the option MUST be copied from the Handoff 1142 Indicator option in the received Proxy Binding Update request. If 1143 the option was not present in the request, the value in the option 1144 MUST be set to zero. 1146 o The Access Technology Type option MUST be present. The access 1147 technology type field in the option MUST be copied from the Access 1148 Technology Type option in the received Proxy Binding Update 1149 request. If the option was not present in the request, the value 1150 in the option MUST be set to zero. 1152 o The Timestamp option MUST be present only if the same option was 1153 present in the received Proxy Binding Update request and MUST NOT 1154 be present otherwise. Considerations from Section 5.5 must be 1155 applied for constructing the Timestamp option. 1157 o The Mobile Node Link-layer Identifier option MUST be present only 1158 if the same option was present in the received Proxy Binding 1159 Update request and MUST NOT be present otherwise. The link-layer 1160 identifier value MUST be copied from the Mobile Node Link-layer 1161 Identifier option present in the received Proxy Binding Update 1162 request. 1164 o The Link-local Address option MUST be present only if the same 1165 option was present in the received Proxy Binding Update request 1166 and MUST NOT be present otherwise. 1168 * If the received Proxy Binding Update request has the Link-local 1169 Address option with any value other than ALL_ZERO, the same 1170 value MUST be copied to the Link-local Address field of the 1171 Binding Cache entry and it must also be copied to the Link- 1172 local Address option in the reply. 1174 * If there is no existing Binding Cache entry (i.e., if this is a 1175 request for a new mobility session), then the local mobility 1176 anchor MUST generate the link-local address that the mobile 1177 access gateway can use on the point-to-point link shared with 1178 the mobile node and the same must be copied to the Link-local 1179 Address field of the Binding Cache entry and it must also be 1180 copied to the Link-local Address option in the reply. 1182 * For all other cases, the link-local address in the option MUST 1183 be copied from the Link-local Address field of the Binding 1184 Cache entry. 1186 o If IPsec is used for protecting the signaling messages, the 1187 message MUST be protected, using the security association existing 1188 between the local mobility anchor and the mobile access gateway. 1190 o Unlike in Mobile IPv6 [RFC-3775], the Type 2 Routing header MUST 1191 NOT be present in the IPv6 header of the packet. 1193 5.4. Multihoming Support 1195 This specification allows mobile nodes to connect to a Proxy Mobile 1196 IPv6 domain through multiple interfaces for simultaneous access. 1197 Following are the key aspects of this multihoming support. 1199 o When a mobile node connects to a Proxy Mobile IPv6 domain through 1200 multiple interfaces for simultaneous access, the local mobility 1201 anchor MUST allocate a mobility session for each of the attached 1202 interfaces. Each of the mobility session should be managed under 1203 a separate Binding Cache entry and with its own lifetime. 1205 o The local mobility anchor MAY allocate more than one home network 1206 prefix for a given interface of the mobile node. However, all the 1207 prefixes associated with a given interface MUST be managed as part 1208 of one mobility session, associated with that interface. 1210 o The local mobility anchor MUST allow for an handoff between two 1211 different interfaces of a mobile node. In such a scenario, all 1212 the home network prefix(es) associated with one interface (part of 1213 one mobility session) will be associated with a different 1214 interface of the mobile node). The decision on when to create a 1215 new mobility session and when to update an existing mobility 1216 session MUST be based on the Handover hint present in the Proxy 1217 Binding Update message and under the considerations specified in 1218 this section. 1220 5.4.1. Binding Cache entry lookup considerations 1222 There can be multiple Binding Cache entries for a given mobile node. 1223 When doing a lookup for a mobile node's Binding Cache entry for 1224 processing a received Proxy Binding Update request message, the local 1225 mobility anchor MUST apply the following multihoming considerations 1226 (in the below specified order, starting with Section 5.4.1.1). These 1227 rules are chained with the processing rules specified in Section 5.3. 1229 5.4.1.1. Mobile Node Link-layer Identifier Option present in the 1230 request 1232 +=====================================================================+ 1233 | Registration/De-Registration Message | 1234 +=====================================================================+ 1235 | HNP Option(s) | 1236 +=====================================================================+ 1237 | ATT | 1238 +=====================================================================+ 1239 | MN-LL-Identifier Option Present (NON_ZERO Value) | 1240 +=====================================================================+ 1241 | HI | 1242 +==================================+==================================+ 1243 | BCE Lookup Keys: (MN-Identifier + ATT + MN-LL-Identifier) | 1244 +=====================================================================+ 1246 Figure 7: BCE Lookup using Link-layer Identifier 1248 1. The local mobility anchor MUST verify if there is an existing 1249 Binding Cache entry, with the mobile node identifier matching the 1250 identifier in the received Mobile Node Identifier option, access 1251 technology type matching the value in the received Access 1252 Technology Type option and the link-layer identifier value 1253 matching the identifier in the received Mobile Node Link-layer 1254 Identifier option. [BCE(MN-Identifier, ATT, MN-LL-Identifier) 1255 equals PBU(MN-Identifier, ATT, MN-LL-Identifier)] 1257 2. If there exists a Binding Cache entry (matching MN-Identifier, 1258 ATT and MN-LL-Identifier), the request MUST be considered as a 1259 request for updating that Binding Cache entry (mobility session). 1261 3. If there does not exist a Binding Cache entry (matching MN- 1262 Identifier, ATT and MN-LL-Identifier) and the Handoff Indicator 1263 field in the Handoff Indicator option present in the request is 1264 set to a value of 2 (Handoff between two different interfaces of 1265 the mobile node). The local mobility anchor MUST apply the 1266 following additional considerations. [PBU(HI) equals 2] 1268 * The local mobility anchor MUST verify if there exists one and 1269 only one Binding Cache entry with the mobile node identifier 1270 matching the identifier in the Mobile Node Identifier option 1271 present in the request and for any link-layer identifier 1272 value. If there exists only one such entry (matching the MN- 1273 Identifier), the request MUST be considered as a request for 1274 updating that Binding Cache entry. [BCE(MN-Identifier) equals 1275 PBU(MN-Identifier)] 1277 4. If there does not exist a Binding Cache entry (matching MN- 1278 Identifier, ATT and MN-LL-Identifier) and if the Handoff 1279 Indicator field in the Handoff Indicator option present in the 1280 request is set to a value of 4 (Handoff state unknown), the local 1281 mobility anchor MUST apply the following additional 1282 considerations. 1284 * The local mobility anchor MUST verify if there exists one and 1285 only one Binding Cache entry with the mobile node identifier 1286 matching the identifier in the Mobile Node Identifier option 1287 present in the request and for any link-layer identifier 1288 value. If there exists only one such entry (matching the MN- 1289 Identifier), the local mobility anchor SHOULD wait till the 1290 existing Binding Cache entry is de-registered by the 1291 previously serving mobile access gateway, before the request 1292 can be considered as a request for updating that Binding Cache 1293 entry. However, if there is no de-registration message that 1294 is received within MaxDelayBeforeNewBCEAssign amount of time, 1295 the local mobility anchor upon accepting the request MUST 1296 consider the request as a request for creating a new mobility 1297 session. The local mobility anchor MAY also choose to create 1298 a new mobility session and without waiting for a de- 1299 registration message and this should be configurable on the 1300 local mobility anchor. 1302 5. For all other cases, the message MUST be considered as a request 1303 for creating a new mobility session. 1305 5.4.1.2. Home Network Prefix Option (NON_ZERO Value) present in the 1306 request 1308 +=====================================================================+ 1309 | Registration/De-Registration Message | 1310 +=====================================================================+ 1311 | At least one HNP Option with NON_ZERO Value | 1312 +=====================================================================+ 1313 | ATT | 1314 +=====================================================================+ 1315 | MN-LL-Identifier Opt Not Present | 1316 +=====================================================================+ 1317 | HI | 1318 +==================================+==================================+ 1319 | BCE Lookup Key: Any of the Home Network Prefixes from the request | 1320 +=====================================================================+ 1322 Figure 8: BCE lookup using home network prefix 1324 If there is at least one Home Network Prefix option present in the 1325 request with NON_ZERO prefix value, the following considerations MUST 1326 be applied. If there are more than instances of the Home Network 1327 Prefix option, any one of the Home Network Prefix options present in 1328 the request (with NON_ZERO prefix value) can be used for locating the 1329 Binding Cache entry. 1331 1. The local mobility anchor MUST verify if there is an existing 1332 Binding Cache entry with one of its home network prefixes 1333 matching the prefix value in one of the Home Network Prefix 1334 options of the received Proxy Binding Update request. [BCE(HNP) 1335 equals PBU(HNP)] 1337 2. If there does not exist a Binding Cache entry (with one its home 1338 network prefixes in the Binding Cache entry matching the prefix 1339 value in one of the Home Network Prefix options of the received 1340 Proxy Binding Update request), the request MUST be considered as 1341 a request for creating a new mobility session. [BCE(HNP) not 1342 equals PBU(HNP)] 1344 3. If there exists a Binding Cache entry (with one of its home 1345 network prefixes in the Binding Cache entry matching the prefix 1346 value in one the Home Network Prefix options of the received 1347 Proxy Binding Update request) but if the mobile node identifier 1348 in the entry does not match the mobile node identifier in the 1349 Mobile Node Identifier option of the received Proxy Binding 1350 Update request, the local mobility anchor MUST reject the request 1351 with the Status field value set to 1352 NOT_AUTHORIZED_FOR_HOME_NETWORK_PREFIX (mobile node is not 1353 authorized for one or more of the requesting home network 1354 prefixes). [BCE(MN-Identifier) not equals PBU(MN-Identifier)] 1356 4. If there exists a Binding Cache entry (matching MN-Identifier and 1357 one of its home network prefixes in the Binding Cache entry 1358 matching the prefix value in one the Home Network Prefix options 1359 of the received Proxy Binding Update request), but if all the 1360 prefixes in the request do not match all the prefixes in the 1361 Binding Cache entry, or if they do not match in count, then the 1362 local mobility anchor MUST reject the request with the Status 1363 field value set to NOT_AUTHORIZED_FOR_HOME_NETWORK_PREFIX (mobile 1364 node is not authorized for the requesting home network prefix). 1365 [BCE(HNP1, HNP2, .. HNPn) not equals PBU(HNP1, HNP2, ..HNPn)] OR 1366 [BCE(Count(HNP))] not equals PBU(Count(HNP))] 1368 5. If there exists a Binding Cache entry (matching MN-Identifier and 1369 all the home network prefixes in the Binding Cache entry matching 1370 all the home network prefixes in the received Proxy Binding 1371 Update request) and if any one or more of these below stated 1372 conditions match, the request MUST be considered as a request for 1373 updating that Binding Cache entry. [BCE(MN-Identifier) equals 1374 PBU(MN-Identifier)] AND [BCE(HNP1, HNP2, .. HNPn) equals 1375 PBU(HNP1, HNP2, ..HNPn)] 1377 * If the Handoff Indicator field in the Handoff Indicator option 1378 present in the request is set to a value of 2 (Handoff between 1379 two different interfaces of the mobile node). [PBU(HI) equals 1380 2] 1382 * The access technology type field in the Access Technology Type 1383 option present in the request matches the access technology 1384 type in the Binding Cache entry and if the Handoff Indicator 1385 field in the Handoff Indicator option present in the request 1386 is set to a value of 3 (Handoff between mobile access gateways 1387 for the same interface). 1389 * If the Proxy-CoA address in the Binding Cache entry matches 1390 the source address of the request (or the address in the 1391 alternate Care-of Address option, if the option is present) 1392 and if the access technology type field in the Access 1393 Technology Type option present in the request matches the 1394 access technology type in the Binding Cache entry. 1395 [BCE(Proxy-CoA, ATT) equals PBU(Proxy-CoA, ATT)]. 1397 6. For all other cases, the message MUST be considered as a request 1398 for creating a new mobility session. 1400 5.4.1.3. Mobile Node Link-layer Identifier Option not present in the 1401 request 1403 +=====================================================================+ 1404 | Registration/De-Registration Message | 1405 +=====================================================================+ 1406 | HNP option with ALL_ZERO Value | 1407 +=====================================================================+ 1408 | ATT | 1409 +=====================================================================+ 1410 | MN-LL-Identifier Option Not Present | 1411 +=====================================================================+ 1412 | HI | 1413 +==================================+==================================+ 1414 | BCE Lookup Key: (MN-Identifier) | 1415 +=====================================================================+ 1417 Figure 9: BCE Lookup using Mobile Node Identifier 1419 1. The local mobility anchor MUST verify if there exists one and 1420 only one Binding Cache entry with the mobile node identifier 1421 matching the identifier in the Mobile Node Identifier option 1422 present in the request. 1424 2. If there exists only one such entry (matching the MN-Identifier) 1425 and the Handoff Indicator field in the Handoff Indicator option 1426 present in the request is set to a value of 2 (Handoff between 1427 two different interfaces of the mobile node) or set to a value of 1428 3 (Handoff between mobile access gateways for the same 1429 interface), then the request MUST be considered as a request for 1430 updating that Binding Cache entry. [PBU(HI) equals 2] or 1431 [PBU(HI) equals 3] 1433 3. If there exists only one such entry (matching the MN-Identifier) 1434 and the Handoff Indicator field in the Handoff Indicator option 1435 present in the request is set to a value of 4 (Handoff state 1436 unknown), the local mobility anchor SHOULD wait till the existing 1437 Binding Cache entry is de-registered by the previously serving 1438 mobile access gateway, before the request can be considered as a 1439 request for updating that Binding Cache entry. However, if there 1440 is no de-registration message that is received within 1441 MaxDelayBeforeNewBCEAssign amount of time, the local mobility 1442 anchor upon accepting the request MUST consider the request as a 1443 request for creating a new mobility session. The local mobility 1444 anchor MAY also choose to create a new mobility session and 1445 without waiting for a de-registration message and this should be 1446 configurable on the local mobility anchor. 1448 4. For all other cases, the message MUST be considered as a request 1449 for creating a new mobility session. 1451 5.5. Timestamp Option for Message Ordering 1453 Mobile IPv6 [RFC-3775] uses the Sequence Number field in binding 1454 registration messages as a way for the home agent to process the 1455 binding updates in the order they were sent by a mobile node. The 1456 home agent and the mobile node are required to manage this counter 1457 over the lifetime of a binding. However, in Proxy Mobile IPv6, as 1458 the mobile node moves from one mobile access gateway to another and 1459 in the absence of mechanisms such as context transfer between the 1460 mobile access gateways, the serving mobile access gateway will be 1461 unable to determine the sequence number that it needs to use in the 1462 signaling messages. Hence, the sequence number scheme, as specified 1463 in [RFC-3775], will be insufficient for Proxy Mobile IPv6. 1465 If the local mobility anchor cannot determine the sending order of 1466 the received binding registration messages, it may potentially 1467 process an older message sent by a mobile access gateway where the 1468 mobile node was previously anchored, but delivered out of order, 1469 resulting in incorrectly updating the mobile node's Binding Cache 1470 entry and creating a routing state for tunneling the mobile node's 1471 traffic to the previously serving gateway. 1473 For solving this problem, this specification adopts two alternative 1474 solutions. One is based on timestamps and the other based on 1475 sequence numbers, as defined in [RFC-3775]. 1477 The basic principle behind the use of timestamps in binding 1478 registration messages is that the node generating the message inserts 1479 the current time-of-day, and the node receiving the message checks 1480 that this timestamp is greater than all previously accepted 1481 timestamps. The timestamp based solution may be used when the 1482 serving mobile access gateways in a Proxy Mobile IPv6 domain do not 1483 have the ability to obtain the last sequence number that was sent in 1484 a binding registration message for updating a given mobile node's 1485 binding. 1487 If the mechanism used for clock synchronization in the Proxy Mobile 1488 IPv6 domain cannot assure a clock drift between the two mobile access 1489 gateways (between which the mobile node did a handoff), which is not 1490 less than half the total time it took for the mobile node to roam 1491 between the two mobile access gateways and the time it took for the 1492 serving mobile access gateway to detect the node on its access link 1493 and construct the Proxy Binding Update message, then this solution 1494 will not predictably work in all cases and hence SHOULD NOT be used. 1496 As an alternative to the Timestamp based approach, the specification 1497 also allows the use of Sequence Number based scheme, as specified in 1498 [RFC-3775]. However, for this scheme to work, the serving mobile 1499 access gateway in a Proxy Mobile IPv6 domain MUST have the ability to 1500 obtain the last sequence number that was sent in a binding 1501 registration message. The sequence number MUST be maintained on a 1502 per mobile node basis and MUST be available to the serving mobile 1503 access gateway. This may be achieved by using context transfer 1504 schemes or by maintaining the sequence number in a policy store. 1505 However, the specific details on how the mobile node's sequence 1506 number is made available to the serving mobile access gateway prior 1507 to sending the binding registration messages is outside the scope of 1508 this document." 1510 Using the Timestamps based approach: 1512 1. A local mobility anchor implementation MUST support the Timestamp 1513 option. If the Timestamp option is present in the received Proxy 1514 Binding Update request message, then the local mobility anchor 1515 MUST include a valid Timestamp option in the Proxy Binding 1516 Acknowledgement message that it sends to the mobile access 1517 gateway. 1519 2. All the mobility entities in a Proxy Mobile IPv6 domain that are 1520 exchanging binding registration messages using the Timestamp 1521 option MUST have adequately synchronized time-of-day clocks. 1522 This is the essential requirement for this solution to work. If 1523 this requirement is not met, the solution will not predictably 1524 work in all cases. 1526 3. The mobility entities in a Proxy Mobile IPv6 domain SHOULD 1527 synchronize their clocks to a common time source. For 1528 synchronizing the clocks, the nodes MAY use the Network Time 1529 Protocol [RFC-4330]. Deployments MAY also adopt other approaches 1530 suitable for that specific deployment. Alternatively, if there 1531 is mobile node generated timestamp that is increasing at every 1532 attachment to the access link and if that timestamp is available 1533 to the mobile access gateway (Ex: The timestamp option in the 1534 SEND messages that the mobile node sends), the mobile access 1535 gateway can use this timestamp or sequence number in the Proxy 1536 Binding Update messages and does not have to depend on any 1537 external clock source. However, the specific details on how this 1538 is achieved is outside the scope of this document. 1540 4. When generating the timestamp value for building the Timestamp 1541 option, the mobility entities MUST ensure that the generated 1542 timestamp is the elapsed time past the same reference epoch, as 1543 specified in the format for the Timestamp option (Section 8.8). 1545 5. If the Timestamp option is present in the received Proxy Binding 1546 Update message, the local mobility anchor MUST ignore the 1547 sequence number field in the message. However, it MUST copy the 1548 sequence number from the received Proxy Binding Update message to 1549 the Proxy Binding Acknowledgement message. 1551 6. Upon receipt of a Proxy Binding Update message with the Timestamp 1552 option, the local mobility anchor MUST check the timestamp field 1553 for validity. In order for it to be considered valid, the 1554 timestamp value contained in the Timestamp option MUST be close 1555 enough (within TimestampValidityWindow amount of time difference) 1556 to the local mobility anchor's time-of-day clock and the 1557 timestamp MUST be greater than all previously accepted timestamps 1558 in the Proxy Binding Update messages sent for that mobile node. 1559 However, if the flag MobileNodeGeneratedTimestampInUse is set to 1560 value of 1, this check MUST NOT be performed. 1562 7. If the timestamp value in the received Proxy Binding Update is 1563 valid (validity as specified in the above considerations) or if 1564 the flag MobileNodeGeneratedTimestampInUse is set to value of 1, 1565 the local mobility anchor MUST return the same timestamp value in 1566 the Timestamp option included in the Proxy Binding 1567 Acknowledgement message that it sends to the mobile access 1568 gateway. 1570 8. If the timestamp value in the received Proxy Binding Update is 1571 lower than the previously accepted timestamp in the Proxy Binding 1572 Update messages sent for that mobility binding, the local 1573 mobility anchor MUST reject the Proxy Binding Update request and 1574 send a Proxy Binding Acknowledgement message with Status field 1575 set to TIMESTAMP_LOWER_THAN_PREV_ACCEPTED (Timestamp lower than 1576 previously accepted timestamp). The message MUST also include 1577 the Timestamp option with the value set to the current time-of- 1578 day on the local mobility anchor. 1580 9. If the timestamp value in the received Proxy Binding Update is 1581 not valid (validity as specified in the above considerations), 1582 the local mobility anchor MUST reject the Proxy Binding Update 1583 and send a Proxy Binding Acknowledgement message with Status 1584 field set to TIMESTAMP_MISMATCH (Timestamp mismatch). The 1585 message MUST also include the Timestamp option with the value set 1586 to the current time-of-day on the local mobility anchor. 1588 Using the Sequence Number based approach: 1590 1. If the Timestamp option is not present in the received Proxy 1591 Binding Update request, the local mobility anchor MUST fall back 1592 to the Sequence Number based scheme. It MUST process the 1593 sequence number field as specified in [RFC-3775]. Also, it MUST 1594 NOT include the Timestamp option in the Proxy Binding 1595 Acknowledgement messages that it sends to the mobile access 1596 gateway. 1598 2. An implementation MUST support the Sequence Number based scheme, 1599 as specified in [RFC-3775]. 1601 3. The Sequence Number based approach can be used only when there is 1602 some mechanism (such as context transfer procedure between mobile 1603 access gateways) that allows the serving mobile access gateway to 1604 obtain the last sequence number that was sent in a binding 1605 registration message for updating a given mobile node's binding. 1607 5.6. Routing Considerations 1609 5.6.1. Bi-Directional Tunnel Management 1611 The bi-directional tunnel MUST be used for routing the mobile node's 1612 data traffic between the mobile access gateway and the local mobility 1613 anchor. A tunnel hides the topology and enables a mobile node to use 1614 address(es) from its home network prefix(es) from any access link in 1615 that Proxy Mobile IPv6 domain. A tunnel may be created dynamically 1616 when needed and removed when not needed. However, implementations 1617 MAY choose to use static pre-established tunnels instead of 1618 dynamically creating and tearing them down on a need basis. The 1619 following considerations MUST be applied when using dynamic tunnels. 1621 o A bi-directional tunnel MUST be established between the local 1622 mobility anchor and the mobile access gateway with IPv6-in-IPv6 1623 encapsulation, as described in [RFC-2473]. The tunnel end points 1624 are the Proxy-CoA and LMAA. When using IPv4 transport, the end 1625 points of the tunnel are the IPv4-LMAA and IPv4-Proxy-CoA, as 1626 specified in [ID-IPV4-PMIP6]. 1628 o Implementations MAY use a software timer for managing the tunnel 1629 lifetime and a counter for keeping a count of all the mobile nodes 1630 that are sharing the tunnel. The timer value can be set to the 1631 accepted binding lifetime and can be updated after each periodic 1632 re-registration for extending the lifetime. If the tunnel is 1633 shared for multiple mobile nodes, the tunnel lifetime must be set 1634 to the highest binding lifetime that is granted to any one of 1635 those mobile nodes sharing that tunnel. 1637 o The tunnel SHOULD be deleted when either the tunnel lifetime 1638 expires or when there are no mobile nodes sharing the tunnel. 1640 5.6.2. Forwarding Considerations 1642 Intercepting Packets Sent to the Mobile Node's Home Network: 1644 o When the local mobility anchor is serving a mobile node, it MUST 1645 be able to receive packets that are sent to the mobile node's home 1646 network. In order for it to receive those packets, it MUST 1647 advertise a connected route in to the Routing Infrastructure for 1648 the mobile node's home network prefix(es) or for an aggregated 1649 prefix with a larger scope. This essentially enables IPv6 routers 1650 in that network to detect the local mobility anchor as the last- 1651 hop router for the mobile node's home network prefix(es). 1653 Forwarding Packets to the Mobile Node: 1655 o On receiving a packet from a correspondent node with the 1656 destination address matching a mobile node's home network 1657 prefix(es), the local mobility anchor MUST forward the packet 1658 through the bi-directional tunnel set up for that mobile node. 1660 o The format of the tunneled packet is shown below. Considerations 1661 from [RFC-2473] MUST be applied for IPv6 encapsulation. However, 1662 when using IPv4 transport, the format of the packet is as 1663 described in [ID-IPV4-PMIP6]. 1665 IPv6 header (src= LMAA, dst= Proxy-CoA /* Tunnel Header */ 1666 IPv6 header (src= CN, dst= MN-HOA ) /* Packet Header */ 1667 Upper layer protocols /* Packet Content*/ 1669 Figure 10: Tunneled Packet from LMA to MAG 1671 o The format of the tunneled packet is shown below, when payload 1672 protection using IPsec is enabled for the mobile node's data 1673 traffic. However, when using IPv4 transport, the format of the 1674 packet is as described in [ID-IPV4-PMIP6]. 1676 IPv6 header (src= LMAA, dst= Proxy-CoA /* Tunnel Header */ 1677 ESP Header in tunnel mode /* ESP Header */ 1678 IPv6 header (src= CN, dst= MN-HoA ) /* Packet Header */ 1679 Upper layer protocols /* Packet Content*/ 1681 Figure 11: Tunneled Packet from LMA to MAG with Payload Protection 1683 Forwarding Packets Sent by the Mobile Node: 1685 o All the reverse tunneled packets that the local mobility anchor 1686 received from the mobile access gateway, after removing the tunnel 1687 header MUST be routed to the destination specified in the inner 1688 packet header. These routed packets will have the source address 1689 field set to the mobile node's home address. Considerations from 1690 [RFC-2473] MUST be applied for IPv6 decapsulation. 1692 5.7. Local Mobility Anchor Address Discovery 1694 Dynamic Home Agent Address Discovery (DHAAD), as explained in Section 1695 10.5 of [RFC-3775], allows a mobile node to discover all the home 1696 agents on its home link by sending an ICMP Home Agent Address 1697 Discovery Request message to the Mobile IPv6 Home-Agents anycast 1698 address, derived from its home network prefix. 1700 The DHAAD message in the current form cannot be used in Proxy Mobile 1701 IPv6 for discovering the address of the mobile node's local mobility 1702 anchor. In Proxy Mobile IPv6, the local mobility anchor will not be 1703 able to receive any messages sent to the Mobile IPv6 Home-Agents 1704 anycast address corresponding to the mobile node's home network 1705 prefix(es), as the prefix(es) is not hosted on any of its interfaces. 1706 Further, the mobile access gateway will not predictably be able to 1707 locate the serving local mobility anchor that has the mobile node's 1708 binding cache entry. Hence, this specification does not support 1709 Dynamic Home Agent Address Discovery protocol. 1711 In Proxy Mobile IPv6, the address of the local mobility anchor 1712 configured to serve a mobile node can be discovered by the mobility 1713 entities in other ways. This may be a configured entry in the mobile 1714 node's policy profile, or it may be obtained through mechanisms 1715 outside the scope of this document. 1717 5.8. Mobile Prefix Discovery Considerations 1719 This specification does not support mobile prefix discovery. The 1720 mobile prefix discovery mechanism as specified in [RFC-3775] is not 1721 applicable to Proxy Mobile IPv6. 1723 5.9. Route Optimization Considerations 1725 The Route Optimization in Mobile IPv6, as defined in [RFC-3775], 1726 enables a mobile node to communicate with a correspondent node 1727 directly using its care-of address and further the Return Routability 1728 procedure enables the correspondent node to have reasonable trust 1729 that the mobile node is reachable at both its home address and 1730 care-of address. 1732 In Proxy Mobile IPv6, the mobile node is not involved in any IP 1733 mobility related signaling. The mobile node uses address(es) from 1734 its home network prefix(es) for all its communication and the Care-of 1735 address (Proxy-CoA) is not visible to the mobile node. Hence, the 1736 Return Routability procedure as defined in Mobile IPv6 [RFC-3775] 1737 cannot be used in Proxy Mobile IPv6. 1739 6. Mobile Access Gateway Operation 1741 The Proxy Mobile IPv6 protocol described in this document introduces 1742 a new functional entity, the Mobile Access Gateway (MAG). The mobile 1743 access gateway is the entity that is responsible for detecting the 1744 mobile node's movements to and from the access link and sending the 1745 binding registration requests to the local mobility anchor. In 1746 essence, the mobile access gateway performs mobility management on 1747 behalf of a mobile node. 1749 The mobile access gateway is a function that typically runs on an 1750 access router. However, implementations MAY choose to split this 1751 function and run it across multiple systems. The specifics on how 1752 that is achieved or the signaling interactions between those 1753 functional entities are beyond the scope of this document. 1755 The mobile access gateway has the following key functional roles: 1757 o It is responsible for detecting the mobile node's movements on the 1758 access link and for initiating the mobility signaling with the 1759 mobile node's local mobility anchor. 1761 o Emulation of the mobile node's home link on the access link by 1762 sending Router Advertisement messages containing the mobile node's 1763 home network prefix(es), each prefix carried using the Prefix 1764 Information option [RFC-4861]. 1766 o Responsible for setting up the data path for enabling the mobile 1767 node to configure one or more addresses from its home network 1768 prefix(es) and use it from the attached access link. 1770 6.1. Extensions to Binding Update List Entry Data Structure 1772 Every mobile access gateway MUST maintain a Binding Update List. 1773 Each entry in the Binding Update List represents a mobile node's 1774 mobility binding with its local mobility anchor. The Binding Update 1775 List is a conceptual data structure, described in Section 11.1 of 1776 [RFC-3775]. 1778 For supporting this specification, the conceptual Binding Update List 1779 entry data structure needs be extended with the following additional 1780 fields. 1782 o The Identifier of the attached mobile node, MN-Identifier. This 1783 identifier is acquired during the mobile node's attachment to the 1784 access link through mechanisms outside the scope of this document. 1786 o The link-layer identifier of the mobile node's connected 1787 interface. This can be acquired from the received Router 1788 Solicitation messages from the mobile node or during the mobile 1789 node's attachment to the access network. This is typically a 1790 link-layer identifier conveyed by the mobile node; however, the 1791 specific details on how that is conveyed is out of scope for this 1792 specification. If this identifier is not available, this variable 1793 length field MUST be set to some default size and MUST be 1794 initialized to a value of ALL_ZERO. 1796 o List of IPv6 home network prefixes assigned to the mobile node's 1797 connected interface. The home network prefix(es) may have been 1798 statically configured in the mobile node's policy profile, or, may 1799 have been dynamically allocated by the local mobility anchor. 1800 Each of these prefix entries will also includes the corresponding 1801 prefix length. 1803 o The Link-local address of the mobile access gateway on the access 1804 link shared with the mobile node. 1806 o The IPv6 address of the local mobility anchor serving the attached 1807 mobile node. This address is acquired from the mobile node's 1808 policy profile or from other means. 1810 o The interface identifier (If-Id) of the point-to-point link 1811 between the mobile node and the mobile access gateway. This is 1812 internal to the mobile access gateway and is used to associate the 1813 Proxy Mobile IPv6 tunnel to the access link where the mobile node 1814 is attached. 1816 o The tunnel interface identifier (If-Id) of the bi-directional 1817 tunnel between the mobile node's local mobility anchor and the 1818 mobile access gateway. This is internal to the mobile access 1819 gateway. The tunnel interface identifier is acquired during the 1820 tunnel creation. 1822 6.2. Mobile Node's Policy Profile 1824 A mobile node's policy profile contains the essential operational 1825 parameters that are required by the network entities for managing the 1826 mobile node's mobility service. These policy profiles are stored in 1827 a local or a remote policy store. The mobile access gateway and the 1828 local mobility anchor MUST be able to obtain a mobile node's policy 1829 profile. The policy profile MAY also be handed over to a serving 1830 mobile access gateway as part of a context transfer procedure during 1831 a handoff or the serving mobile access gateway MAY be able to 1832 dynamically generate this profile. The exact details on how this 1833 achieved is outside the scope of this document. However, this 1834 specification requires that a mobile access gateway serving a mobile 1835 node MUST have access to its policy profile. 1837 The following are the mandatory fields of the policy profile: 1839 o The mobile node's identifier (MN-Identifier) 1841 o The IPv6 address of the local mobility anchor (LMAA) 1843 The following are the optional fields of the policy profile: 1845 o The mobile node's IPv6 home network prefix(es) assigned to the 1846 mobile node's connected interface 1848 o The mobile node's IPv6 home network Prefix lifetime. This 1849 lifetime will be same for all the hosted prefixes on the link, as 1850 they all are part of one mobility session. 1852 o Supported address configuration procedures (Stateful, Stateless or 1853 both) for the mobile node in the Proxy Mobile IPv6 domain 1855 6.3. Supported Access Link Types 1857 This specification supports only point-to-point access link types and 1858 thus it assumes that the mobile node and the mobile access gateway 1859 are the only two nodes on the access link. The link is assumed to 1860 have multicast capability. This protocol may also be used on other 1861 link types, as long as the link is configured in such a way that it 1862 emulates point-to-point delivery between the mobile node and the 1863 mobile access gateway for all the protocol traffic. 1865 6.4. Supported Address Configuration Modes 1867 A mobile node in the Proxy Mobile IPv6 domain can configure one or 1868 more global IPv6 addresses on its interface (using Stateless, 1869 Stateful or manual address autoconfiguration procedures) from the 1870 hosted prefix(es) on that link. The Router Advertisement messages 1871 sent on the access link specify the address configuration methods 1872 permitted on that access link for that mobile node. However, the 1873 advertised flags with respect to the address configuration will be 1874 consistent for a mobile node, on any of the access links in that 1875 Proxy Mobile IPv6 domain. Typically, these configuration settings 1876 will be based on the domain wide policy or based on a policy specific 1877 to each mobile node. 1879 When stateless address autoconfiguration is supported on the access 1880 link, the mobile node can generate one or more IPv6 addresses from 1881 the hosted prefix(es) by standard IPv6 mechanisms such as Stateless 1882 Autoconfiguration [RFC-4862] or Privacy extensions [RFC-4941]. 1884 When stateful address autoconfiguration is supported on the link, the 1885 mobile node can obtain the address configuration from the DHCPv6 1886 server located in the Proxy Mobile IPv6 domain, by standard DHCPv6 1887 mechanisms, as specified in [RFC-3315]. The obtained address(es) 1888 will be from its home network prefix(es). Section 6.11 specifies the 1889 details on how this configuration can be achieved. 1891 Additionally, other address configuration mechanisms specific to the 1892 access link between the mobile node and the mobile access gateway may 1893 also be used for delivering the address configuration to the mobile 1894 node. This specification does not modify the behavior of any of the 1895 standard IPv6 address configuration mechanisms. 1897 6.5. Access Authentication & Mobile Node Identification 1899 When a mobile node attaches to an access link connected to the mobile 1900 access gateway, the deployed access security protocols on that link 1901 SHOULD ensure that the network-based mobility management service is 1902 offered only after authenticating and authorizing the mobile node for 1903 that service. The exact specifics on how this is achieved or the 1904 interactions between the mobile access gateway and the access 1905 security service is outside the scope of this document. This 1906 specification goes with the stated assumption of having an 1907 established trust between the mobile node and the mobile access 1908 gateway, before the protocol operation begins. 1910 6.6. Acquiring Mobile Node's Identifier 1912 All the network entities in a Proxy Mobile IPv6 domain MUST be able 1913 to identify a mobile node, using its MN-Identifier. This identifier 1914 MUST be stable and unique across the Proxy Mobile IPv6 domain. The 1915 mobility entities in the Proxy Mobile IPv6 domain MUST be able to use 1916 this identifier in the signaling messages and unambiguously identify 1917 a given mobile node. Following are some of the considerations 1918 related to this MN-Identifier. 1920 o The MN-Identifier is typically obtained as part of the access 1921 authentication or from a notified network attachment event. In 1922 cases where the user identifier authenticated during access 1923 authentication uniquely identifies a mobile node, the MN- 1924 Identifier MAY be the same as the user identifier. However, the 1925 user identifier MUST NOT be used if it identifies a user account 1926 that can be used from more than one mobile node operating in the 1927 same Proxy Mobile IPv6 domain. 1929 o In some cases, the obtained identifier as part of the access 1930 authentication can be a temporary identifier and further that 1931 temporary identifier may be different at each re-authentication. 1932 However, the mobile access gateway MUST be able to use this 1933 temporary identifier and obtain the mobile node's stable 1934 identifier from the policy store. For instance, in AAA-based 1935 systems the RADIUS attribute, Chargeable-User-Identifier [RFC- 1936 4372] may be used, as long as it uniquely identifies a mobile 1937 node, and not a user account that can be used with multiple mobile 1938 nodes. 1940 o In some cases and for privacy reasons, the MN-Identifier that the 1941 policy store delivers to the mobile access gateway may not be the 1942 true identifier of the mobile node. However, the mobility access 1943 gateway MUST be able to use this identifier in the signaling 1944 messages exchanged with the local mobility anchor. 1946 o The mobile access gateway MUST be able to identify the mobile node 1947 by its MN-Identifier and it MUST be able to associate this 1948 identity to the point-to-point link shared with the mobile node. 1950 6.7. Home Network Emulation 1952 One of the key functions of a mobile access gateway is to emulate the 1953 mobile node's home network on the access link. It must ensure, the 1954 mobile node believes it is still connected to its home link or on the 1955 link where it obtained its initial address configuration after it 1956 moved into that Proxy Mobile IPv6 domain. 1958 For emulating the mobile node's home link on the access link, the 1959 mobile access gateway must be able to send Router Advertisement 1960 messages advertising the mobile node's home network prefix(es) 1961 carried using the Prefix Information option(s) [RFC-4861] and with 1962 other address configuration parameters consistent with its home link 1963 properties. Typically, these configuration settings will be based on 1964 the domain wide policy or based on a policy specific to each mobile 1965 node. 1967 Typically, the mobile access gateway learns the mobile node's home 1968 network prefix(es) details from the received Proxy Binding 1969 Acknowledgement message or it may obtain them from the mobile node's 1970 policy profile. However, the mobile access gateway SHOULD send the 1971 Router Advertisements advertising the mobile node's home network 1972 prefix(es) only after successfully completing the binding 1973 registration with the mobile node's local mobility anchor. 1975 When advertising the home network prefix(es) in the Router 1976 Advertisement messages, the mobile access gateway MAY set the prefix 1977 lifetime value for the advertised prefix(es) to any chosen value at 1978 its own discretion. An implementation MAY choose to tie the prefix 1979 lifetime to the mobile node's binding lifetime. The prefix lifetime 1980 can also be an optional configuration parameter in the mobile node's 1981 policy profile. 1983 6.8. Link-Local and Global Address Uniqueness 1985 A mobile node in the Proxy Mobile IPv6 domain, as it moves from one 1986 mobile access gateway to the other, will continue to detect its home 1987 network and thus believe it is still on the same link. Every time 1988 the mobile node attaches to a new link, the event related to the 1989 interface state change will trigger the mobile node to perform DAD 1990 operation on the link-local and global address(es). However, if the 1991 mobile node is DNAv6 enabled, as specified in [ID-DNAV6], it may not 1992 detect the link change due to DNAv6 optimizations and may not trigger 1993 the duplicate address detection (DAD) procedure for its existing 1994 addresses, which may potentially lead to address collisions after the 1995 mobile node's handoff to a new link. 1997 The issue of address collision is not relevant to the mobile node's 1998 global address(es). Since the assigned home network prefix(es) are 1999 for the mobile node's exclusive usage, no other node shares an 2000 address (other than Subnet-Router anycast address which is configured 2001 by the mobile access gateway) from the prefix(es) and so the 2002 uniqueness for the mobile node's global address is assured on the 2003 access link. 2005 The issue of address collision is however relevant to the mobile 2006 node's link-local addresses since the mobile access gateway and the 2007 mobile node will have link-local addresses configured from the same 2008 link-local prefix (FE80::/64). This leaves a room for link-local 2009 address collision between the two neighbors (i.e., the mobile node 2010 and the mobile access gateway) on that access link. For solving this 2011 problem, this specification requires that the link-local address that 2012 the mobile access gateway configures on the point-to-point link 2013 shared with a given mobile node be generated by the local mobility 2014 anchor and be stored in the mobile node's Binding Cache entry. This 2015 address will not change for the duration of that mobile node's 2016 session and can be provided to the serving mobile access gateway at 2017 every mobile node's handoff, as part of the Proxy Mobile IPv6 2018 signaling messages. The specific method by which the local mobility 2019 anchor generates the link-local address is out of scope for this 2020 specification. 2022 Optionally, implementations MAY choose to configure a fixed link- 2023 local address across all the access links in a Proxy Mobile IPv6 2024 domain and without a need for carrying this address from the local 2025 mobility anchor to the mobile access gateway in the Proxy Mobile IPv6 2026 signaling messages. 2028 6.9. Signaling Considerations 2030 6.9.1. Binding Registrations 2032 6.9.1.1. Mobile Node Attachment and Initial Binding Registration 2034 1. After detecting a new mobile node on its access link, the mobile 2035 access gateway MUST identify the mobile node and acquire its MN- 2036 Identifier. If it determines that the network-based mobility 2037 management service needs to be offered to the mobile node, it 2038 MUST send a Proxy Binding Update message to the local mobility 2039 anchor. 2041 2. The Proxy Binding Update message MUST include the Mobile Node 2042 Identifier option [RFC-4283], carrying the MN-Identifier for 2043 identifying the mobile node. 2045 3. The Home Network Prefix option(s) MUST be present in the Proxy 2046 Binding Update message. If the mobile access gateway learns the 2047 mobile node's home network prefix(es) either from its policy 2048 store or from other means, the mobile access gateway MAY choose 2049 to request the local mobility anchor to allocate the requested 2050 prefix(es) by including a Home Network Prefix option for each of 2051 those requested prefixes. The mobile access gateway MAY also 2052 choose to include just one Home Network Prefix option with the 2053 prefix value of ALL_ZERO, for requesting the local mobility 2054 anchor to do the prefix assignment. However, when including a 2055 Home Network Prefix option with the prefix value of ALL_ZERO, 2056 then there MUST be only one instance of the Home Network prefix 2057 option in the request. 2059 4. The Handoff Indicator option MUST be present in the Proxy 2060 Binding Update message. The Handoff Indicator field in the 2061 Handoff Indicator option MUST be set to a value indicating the 2062 handoff hint. 2064 * The Handoff Indicator field MUST be set to value 1 2065 (Attachment over a new interface), if the mobile access 2066 gateway determines (under the Handoff Indicator 2067 considerations specified in this section) that the mobile 2068 node's current attachment to the network over this interface 2069 is not as a result of a handoff of an existing mobility 2070 session (over the same interface or through a different 2071 interface), but as a result of an attachment over a new 2072 interface. This essentially serves as a request to the local 2073 mobility anchor to create a new mobility session and not 2074 update any existing Binding Cache entry created for the same 2075 mobile node connected to the Proxy Mobile IPv6 domain through 2076 a different interface. 2078 * The Handoff Indicator field MUST be set to value 2 (Handoff 2079 between two different interfaces of the mobile node), if the 2080 mobile access gateway definitively knows the mobile node's 2081 current attachment is due to a handoff of an existing 2082 mobility session, between two different interfaces of the 2083 mobile node. 2085 * The Handoff Indicator field MUST be set to value 3 (Handoff 2086 between mobile access gateways for the same interface), if 2087 the mobile access gateway definitively knows the mobile 2088 node's current attachment is due to a handoff of an existing 2089 mobility session between two mobile access gateways and for 2090 the same interface of the mobile node. 2092 * The Handoff Indicator field MUST be set to value 4 (Handoff 2093 state unknown), if the mobile access gateway cannot determine 2094 if the mobile node's current attachment is due to a handoff 2095 of an existing mobility session. 2097 5. The mobile access gateway MUST apply the below considerations 2098 when choosing the value for the Handoff Indicator field. 2100 * The mobile access gateway can choose to use the value 2 2101 (Handoff between two different interfaces of the mobile 2102 node), only when it knows that the mobile node has on purpose 2103 switched from one interface to another, and the previous 2104 interface is going to be disabled. It may know this due to a 2105 number of factors. For instance, most cellular networks have 2106 controlled handovers where the network knows that the host is 2107 moving from one attachment to another. In this situation the 2108 link layer mechanism can inform the mobility functions that 2109 this is indeed a movement, not a new attachment. 2111 * Some link layers have link-layer identifiers that can be used 2112 to distinguish (a) the movement of a particular interface to 2113 a new attachment from (b) the attachment of a new interface 2114 from the same host. Option value 3 (Handoff between mobile 2115 access gateways for the same interface)is appropriate in case 2116 a and value of 1 (Attachment over a new interface) in case b. 2118 * The mobile access gateway MUST NOT set the option value to 2 2119 (Handoff between two different interfaces of the mobile node) 2120 or 3 (Handoff between mobile access gateways for the same 2121 interface) if it can not be determined that the mobile node 2122 can move the address between the interfaces involved in the 2123 handover or that it is the same interface that has moved. 2124 Otherwise Proxy Mobile IPv6-unaware hosts that have multiple 2125 physical interfaces to the same domain may suffer unexpected 2126 failures. 2128 * Where no support from the link layer exists, the host and the 2129 network would need to inform each other about the intended 2130 movement. The Proxy Mobile IPv6 protocol does not specify 2131 this and simply requires that knowledge about movements can 2132 be derived either from the link-layer or from somewhere else. 2133 The method by which this is accomplished is outside the scope 2134 of this specification. 2136 6. Either the Timestamp option or a valid sequence number 2137 maintained on a per mobile node basis (if the Sequence Number 2138 based scheme is in use) MUST be present. When Timestamp option 2139 is added to the message, the mobile access gateway SHOULD also 2140 set the Sequence Number field to a value of a monotonically 2141 increasing counter (not to be confused with the per mobile node 2142 sequence number specified in [RFC-3775]). The local mobility 2143 anchor will ignore this field when there is a Timestamp option 2144 present in the request, but will return the same value in the 2145 Proxy Binding Acknowledgement message. This will be useful for 2146 matching the reply to the request message. 2148 7. The Mobile Node Link-layer Identifier option carrying the link- 2149 layer identifier of the currently attached interface MUST be 2150 present in the Proxy Binding Update message, if the mobile 2151 access gateway is aware of the same. If the link-layer 2152 identifier of the currently attached interface is not known or 2153 if the identifier value is ALL_ZERO, this option MUST NOT be 2154 present. 2156 8. The Access Technology Type option MUST be present in the Proxy 2157 Binding Update message. The access technology type field in the 2158 option SHOULD be set to the type of access technology using 2159 which the mobile node is currently attached to the mobile access 2160 gateway. 2162 9. The Link-local Address option MAY be present in the Proxy 2163 Binding Update message. Considerations from Section 6.8 MUST be 2164 applied when using the link-local address option. 2166 * When querying the local mobility anchor for the link-local 2167 address that it should use on the point-to-point link shared 2168 with the mobile node, this option MUST be set to ALL_ZERO. 2169 This essentially serves as a request to the local mobility 2170 anchor to return the link-local address of the mobile access 2171 gateway stored in the binding cache entry associated with 2172 this mobility session. 2174 * When uploading the link-local address to the local mobility 2175 anchor, the value in the option MUST be set to the link-local 2176 address that is configured on the point-to-point link shared 2177 with the mobile node. This is allowed only during an initial 2178 mobile node's attachment. 2180 10. The Proxy Binding Update message MUST be constructed as 2181 specified in Section 6.9.1.5. 2183 11. If there is no existing Binding Update List entry for that 2184 mobile node, the mobile access gateway MUST create a Binding 2185 Update List entry for the mobile node upon sending the Proxy 2186 Binding Update request. 2188 6.9.1.2. Receiving Binding Registration Reply 2190 On receiving a Proxy Binding Acknowledgement message (format 2191 specified in Section 8.2) from the local mobility anchor, the mobile 2192 access gateway MUST process the message as specified below. 2194 1. The received Proxy Binding Acknowledgement message (a Binding 2195 Acknowledgement message with the 'P' flag set to value of 1) 2196 MUST be authenticated as described in Section 4. When IPsec is 2197 used for message authentication, the SPI in the IPsec header 2198 [RFC-4306] of the received packet is needed for locating the 2199 security association, for authenticating the Proxy Binding 2200 Acknowledgement message. 2202 2. The mobile access gateway MUST observe the rules described in 2203 Section 9.2 of [RFC-3775] when processing Mobility Headers in 2204 the received Proxy Binding Acknowledgement message. 2206 3. The mobile access gateway MUST apply the considerations 2207 specified in Section 5.5 for processing the Sequence Number 2208 field and the Timestamp option (if present), in the message. 2210 4. The mobile access gateway MUST ignore any checks, specified in 2211 [RFC-3775] related to the presence of a Type 2 Routing header in 2212 the Proxy Binding Acknowledgement message. 2214 5. The mobile access gateway MAY use the mobile node identifier 2215 present in the Mobile Node Identifier option for matching the 2216 response to the request messages that it sent recently. 2217 However, if there is more than one request message in its 2218 request queue for the same mobile node, the sequence number 2219 field can be used for identifying the exact message from those 2220 messages. There are other ways to achieve this and 2221 implementations are free to adopt the best approach that suits 2222 their implementation. Additionally, if the received Proxy 2223 Binding Acknowledgement message does not match any of the Proxy 2224 Binding Update messages that it sent recently, the message MUST 2225 be ignored. 2227 6. If the received Proxy Binding Acknowledgement message has any 2228 one or more of the following options, Handoff Indicator option, 2229 Access Technology Type option, Mobile Node Link-layer Identifier 2230 option, Mobile Node Identifier option, carrying option values 2231 that are different from the option values present in the 2232 corresponding request (Proxy Binding Update) message, the 2233 message MUST be ignored as the local mobility anchor is expected 2234 to echo back all these listed options and with the same option 2235 values in the reply message. Further, the mobile access gateway 2236 MUST NOT retransmit the Proxy Binding Update message till an 2237 administrative action is taken. 2239 7. If the received Proxy Binding Acknowledgement message has the 2240 Status field value set to PROXY_REG_NOT_ENABLED (Proxy 2241 registration not enabled for the mobile node), the mobile access 2242 gateway SHOULD NOT send binding registration requests again for 2243 that mobile node. It MUST deny the mobility service to that 2244 mobile node. 2246 8. If the received Proxy Binding Acknowledgement message has the 2247 Status field value set to TIMESTAMP_LOWER_THAN_PREV_ACCEPTED 2248 (Timestamp value lower than previously accepted value), the 2249 mobile access gateway SHOULD try to register again to reassert 2250 the mobile node's presence on its access link. The mobile 2251 access gateway is not specifically required to synchronize its 2252 clock upon receiving this error code. 2254 9. If the received Proxy Binding Acknowledgement message has the 2255 Status field value set to TIMESTAMP_MISMATCH (Invalid timestamp 2256 value), the mobile access gateway SHOULD try to register again 2257 only after it has synchronized its clock to a common time source 2258 that is used by all the mobility entities in that domain for 2259 their clock synchronization. The mobile access gateway SHOULD 2260 NOT synchronize its clock to the local mobility anchor's system 2261 clock, based on the timestamp present in the received message. 2263 10. If the received Proxy Binding Acknowledgement message has the 2264 Status field value set to NOT_AUTHORIZED_FOR_HOME_NETWORK_PREFIX 2265 (The mobile node is not authorized for one or more of the 2266 requesting home network prefix(es)), the mobile access gateway 2267 SHOULD NOT request for the same prefix(es) again, but can only 2268 request the local mobility anchor to do the assignment of 2269 prefix(es) by including only one Home Network Prefix option with 2270 the prefix value set to ALL_ZERO. 2272 11. If the received Proxy Binding Acknowledgement message has the 2273 Status field value set to any value greater than or equal to 128 2274 (i.e., if the binding is rejected), the mobile access gateway 2275 MUST NOT advertise the mobile node's home network prefix(es) in 2276 the Router Advertisement messages sent on that access link and 2277 MUST deny the mobility service to the mobile node by not 2278 forwarding any packets received from the mobile node using an 2279 address from the home network prefix(es). It MAY also tear down 2280 the point-to-point link shared with the mobile node. 2282 12. If the received Proxy Binding Acknowledgement message has the 2283 Status field value set to 0 (Proxy Binding Update accepted), the 2284 mobile access gateway MUST setup the routing state, as explained 2285 in section 6.10, and MUST also update the Binding Update List 2286 entry for reflecting the accepted binding registration status. 2287 It MUST also advertise the mobile node's home network prefix(es) 2288 as the hosted on-link prefixes, by including them in the Router 2289 Advertisement messages that it sends on that access link. 2291 13. If the received Proxy Binding Acknowledgement message has the 2292 address in the Link-local Address option set to a NON_ZERO 2293 value, the mobile access gateway MUST configure that link-local 2294 address on that point-to-point link and MUST NOT configure any 2295 other link-local address on that point-to-point link. This will 2296 avoid any link-local address collisions with the mobile node on 2297 that access link. 2299 6.9.1.3. Extending Binding Lifetime 2301 1. For extending the lifetime of a currently registered mobile node 2302 (i.e., after a successful initial binding registration from the 2303 same mobile access gateway), the mobile access gateway can send a 2304 Proxy Binding Update message to the local mobility anchor with a 2305 new lifetime value. This re-registration message MUST be 2306 constructed with the same set of options as the initial binding 2307 registration message, under the considerations specified in 2308 Section 6.9.1.1. However the following exceptions apply. 2310 2. There MUST be a Home Network Prefix option for each of the 2311 assigned home network prefixes assigned for that mobility session 2312 and with the prefix value in the option set to that respective 2313 prefix value. 2315 3. The Handoff Indicator field in the Handoff Indicator option MUST 2316 be set to a value of 5 (Handoff state not changed - Re- 2317 Registration). 2319 6.9.1.4. Mobile Node Detachment and Binding De-Registration 2321 1. If at any point the mobile access gateway detects that the mobile 2322 node has moved away from its access link, or if it decides to 2323 terminate the mobile node's mobility session, it SHOULD send a 2324 Proxy Binding Update message to the local mobility anchor with 2325 the lifetime value set to zero. This de-registration message 2326 MUST be constructed with the same set of options as the initial 2327 binding registration message, under the considerations specified 2328 in Section 6.9.1.1. However, the following exceptions apply. 2330 2. There MUST be a Home Network Prefix option for each of the 2331 assigned home network prefix(es) assigned for that mobility 2332 session and with the prefix value in the option set to the 2333 respective prefix value. 2335 3. The Handoff Indicator field in the Handoff Indicator option MUST 2336 be set to a value of 4 (Handoff state unknown). 2338 Either upon receipt of a Proxy Binding Acknowledgement message from 2339 the local mobility anchor or after INITIAL_BINDACK_TIMEOUT [RFC-3775] 2340 timeout waiting for the reply, the mobile access gateway MUST do the 2341 following: 2343 1. It MUST remove the Binding Update List entry for the mobile node 2344 from its Binding Update List. 2346 2. It MUST remove the created routing state for tunneling the mobile 2347 node's traffic. 2349 3. If there is a dynamically created tunnel to the mobile node's 2350 local mobility anchor and if there are not other mobile nodes for 2351 which the tunnel is being used, then the tunnel MUST be deleted. 2353 4. It MUST tear down the point-to-point link shared with the mobile 2354 node. This action will force the mobile node to remove any IPv6 2355 address configuration on the interface connected to this point- 2356 to-point link. 2358 6.9.1.5. Constructing the Proxy Binding Update Message 2360 o The mobile access gateway when sending the Proxy Binding Update 2361 request to the local mobility anchor MUST construct the message as 2362 specified below. 2364 IPv6 header (src=Proxy-CoA, dst=LMAA) 2365 Mobility header 2366 - BU /* P & A flags MUST be set to value 1 */ 2367 Mobility Options 2368 - Mobile Node Identifier option (mandatory) 2369 - Home Network Prefix option(s) (mandatory) 2370 - Handoff Indicator option (mandatory) 2371 - Access Technology Type option (mandatory) 2372 - Timestamp option (optional) 2373 - Mobile Node Link-layer Identifier option (optional) 2374 - Link-local Address option (optional) 2376 Figure 12: Proxy Binding Update message format 2378 o The Source Address field in the IPv6 header of the message MUST be 2379 set to the global address configured on the egress interface of 2380 the mobile access gateway. When there is no Alternate Care-of 2381 Address option present in the request, this address will be 2382 considered as the Proxy-CoA address for this binding registration 2383 request. However, when there is Alternate Care-of Address option 2384 present in the request, this address will be not be considered as 2385 the Proxy-CoA address, but the address in the alternate Care-of 2386 Address option will be considered as the Proxy-CoA address. 2388 o The Destination Address field in the IPv6 header of the message 2389 MUST be set to the local mobility anchor address. 2391 o The Mobile Node Identifier option [RFC-4283] MUST be present. 2393 o At least one Home Network Prefix option MUST be present. 2395 o The Handoff Indicator option MUST be present. 2397 o The Access Technology Type option MUST be present. 2399 o The Timestamp option MAY be present. 2401 o The Mobile Node Link-layer Identifier option MAY be present. 2403 o The Link-local Address option MAY be present. 2405 o If IPsec is used for protecting the signaling messages, the 2406 message MUST be protected, using the security association existing 2407 between the local mobility anchor and the mobile access gateway. 2409 o Unlike in Mobile IPv6 [RFC-3775], the Home Address option [RFC- 2410 3775] MUST NOT be present in the IPv6 Destination Options 2411 extension header of the Proxy Binding Update message. 2413 6.9.2. Router Solicitation Messages 2415 A mobile node may send a Router Solicitation message on the access 2416 link shared with the mobile access gateway. The Router Solicitation 2417 message that the mobile node sends is as specified in [RFC-4861]. 2418 The mobile access gateway on receiving the Router Solicitation 2419 message or before sending a Router Advertisement message MUST apply 2420 the following considerations. 2422 1. The mobile access gateway on receiving the Router Solicitation 2423 message SHOULD send a Router Advertisement message containing the 2424 mobile node's home network prefix(es) as the on-link prefix(es). 2425 However, before sending the Router Advertisement message 2426 containing the mobile node's home network prefix(es), it SHOULD 2427 complete the binding registration process with the mobile node's 2428 local mobility anchor. 2430 2. If the local mobility anchor rejects the binding registration 2431 request, or, if the mobile access gateway failed to complete the 2432 binding registration process for whatever reason, the mobile 2433 access gateway MUST NOT advertise the mobile node's home network 2434 prefix(es) in the Router Advertisement messages that it sends on 2435 the access link. However, it MAY choose to advertise a local 2436 visited network prefix(es) to enable the mobile node for regular 2437 IPv6 access. 2439 3. The mobile access gateway SHOULD add the MTU option, as specified 2440 in [RFC-4861], to the Router Advertisement messages that it sends 2441 on the access link. This will ensure the mobile node on the link 2442 uses the advertised MTU value. The MTU value MUST reflect the 2443 tunnel MTU for the bi-directional tunnel between the mobile 2444 access gateway and the local mobility anchor. Considerations 2445 from Section 6.9.5 SHOULD be applied for determining the tunnel 2446 MTU value. 2448 6.9.3. Default-Router 2450 In Proxy Mobile IPv6, the mobile access gateway is the IPv6 default- 2451 router for the mobile node on the access link, as it is the entity 2452 that sends the Router Advertisements on the access link. However, as 2453 the mobile node moves from one access link to another, the serving 2454 mobile access gateway on those respective links will send the Router 2455 Advertisement messages. If these Router Advertisements are sent 2456 using a different link-local address or a different link-layer 2457 address, the mobile node will always detect a new default-router 2458 after every handoff. For solving this problem, this specification 2459 requires all the mobile access gateways in the Proxy Mobile IPv6 2460 domain to use the same link-local and link-layer address on any of 2461 the access links where ever the mobile node attaches. These 2462 addresses can be fixed addresses across the entire Proxy Mobile IPv6 2463 domain and all the mobile access gateways can use these globally 2464 fixed address on any of the point-to-point links. Additionally, this 2465 specification allows the local mobility anchor to generate the link- 2466 local address and provide it to the mobile access gateway as part of 2467 the signaling messages. 2469 However, both of these approaches (a link-local address generated by 2470 the local mobility anchor or when using a globally fixed link-local 2471 address) have implications on the deployment of SEcure Neighbor 2472 Discovery (SEND) [RFC-3971]. In SEND, routers have certificates and 2473 public key pairs, and their Router Advertisements are signed with the 2474 private keys of these key pairs. When a number of different routers 2475 use the same addresses, the routers either all have to be able to 2476 construct these signatures for the same key pair, or the used key 2477 pair and the router's cryptographic identity must change after a 2478 movement. Both approaches are problematic. Sharing of private key 2479 information across a number of nodes would be inappropriate. And 2480 changing even the cryptographic identity of the router goes against 2481 the general idea of the Proxy Mobile IPv6 being as invisible to the 2482 hosts as possible. 2484 There is, however, ongoing work at the IETF to revise the SEND 2485 specifications. It is suggested that these revisions also address 2486 the above problem. Other revisions are needed to deal with other 2487 problematic cases (such as Neighbor Discovery proxies) before wide- 2488 spread deployment of SEND. 2490 6.9.4. Retransmissions and Rate Limiting 2492 The mobile access gateway is responsible for retransmissions and rate 2493 limiting the binding registration requests that it sends to the local 2494 mobility anchor. The Retransmission and the Rate Limiting rules are 2495 as specified in [RFC-3775]. However, the following considerations 2496 MUST be applied. 2498 1. When the mobile access gateway sends a Proxy Binding Update 2499 request, it should use the constant, INITIAL_BINDACK_TIMEOUT 2500 [RFC-3775], for configuring the retransmission timer, as 2501 specified in Section 11.8 [RFC-3775]. However, the mobile access 2502 gateway is not required to use a longer retransmission interval 2503 of InitialBindackTimeoutFirstReg as specified in [RFC-3775] for 2504 the initial binding registration request. 2506 2. If the mobile access gateway fails to receive a valid matching 2507 response for a registration or re-registration message within the 2508 retransmission interval, it SHOULD retransmit the message until a 2509 response is received. However, the mobile access gateway MUST 2510 ensure the mobile node is still attached to the connected link 2511 before retransmitting the message. 2513 3. As specified in Section 11.8 of [RFC-3775], the mobile access 2514 gateway MUST use an exponential back-off process in which the 2515 timeout period is doubled upon each retransmission, until either 2516 the node receives a response or the timeout period reaches the 2517 value MAX_BINDACK_TIMEOUT [RFC-3775]. The mobile access gateway 2518 MAY continue to send these messages at this slower rate 2519 indefinitely. 2521 4. If the Timestamp based scheme is in use, the retransmitted Proxy 2522 Binding Update messages MUST use the latest timestamp. If the 2523 Sequence number scheme is in use, the retransmitted Proxy Binding 2524 Update messages MUST use a Sequence Number value greater than 2525 that used for the previous transmission of this Proxy Binding 2526 Update message, just as specified in [RFC-3775]. 2528 6.9.5. Path MTU Discovery 2530 For getting optimal throughput, it is required that the routed 2531 packets between the local mobility anchor and the mobile access 2532 gateway are sent in the largest size and without fragmentation. If 2533 the mobility entities are aware of the Path MTU (PMTU) between 2534 themselves, it can be used for determining the Tunnel Path MTU and 2535 also for advertising this value as the link MTU on the access link 2536 shared with the mobile node. The following are some of the 2537 considerations related to Path MTU discovery. 2539 o The local mobility anchor and mobile access gateway MAY use the 2540 Path MTU Discovery mechanisms as specified in [RFC-1981] and [RFC- 2541 4821]. for determining the Path MTU (PMTU) for the path between 2542 themselves. 2544 o The local mobility anchor and the mobile access gateway MAY use 2545 any standard application probes for determining the PMTU. The 2546 specifics details related to the type of traffic that can be used 2547 for the PMTU discovery is outside the scope of this document. 2549 o If there is an administratively configured PMTU value for the path 2550 between the local mobility anchor and the mobile access gateway, 2551 the dynamic discovery of PMTU is not required. 2553 o The IPv6 tunnel MTU for the established tunnel between the local 2554 mobility anchor and the mobile access gateway can be computed 2555 based on this Path MTU value, as specified in Section 6.7 of [RFC- 2556 2473]. 2558 o The mobile access gateway MAY use this determined tunnel Path MTU 2559 value (for the tunnel established with the mobile node's local 2560 mobility anchor) as the MTU value in the MTU option that it sends 2561 in the Router Advertisements on the access link shared with the 2562 mobile node. 2564 6.10. Routing Considerations 2566 This section describes how the mobile access gateway handles the 2567 traffic to/from the mobile node that is attached to one of its access 2568 interfaces. 2570 Proxy-CoA LMAA 2571 | | 2572 +--+ +---+ +---+ +--+ 2573 |MN|----------|MAG|======================|LMA|----------|CN| 2574 +--+ +---+ +---+ +--+ 2575 IPv6 Tunnel 2577 Figure 13: Proxy Mobile IPv6 Tunnel 2579 6.10.1. Transport Network 2581 As per this specification, the transport network between the local 2582 mobility anchor and the mobile access gateway is an IPv6 network. 2583 The companion document [ID-IPV4-PMIP6] specifies the required 2584 extensions for negotiating IPv4 transport and the corresponding 2585 encapsulation mode. 2587 6.10.2. Tunneling & Encapsulation Modes 2589 An IPv6 address that a mobile node uses from its home network 2590 prefix(es) is topologically anchored at the local mobility anchor. 2591 For a mobile node to use this address from an access network attached 2592 to a mobile access gateway, proper tunneling techniques have to be in 2593 place. Tunneling hides the network topology and allows the mobile 2594 node's IPv6 datagram to be encapsulated as a payload of another IPv6 2595 packet and to be routed between the local mobility anchor and the 2596 mobile access gateway. The Mobile IPv6 base specification [RFC-3775] 2597 defines the use of IPv6-over-IPv6 tunneling [RFC-2473], between the 2598 home agent and the mobile node and this specification extends the use 2599 of the same tunneling mechanism for use between the local mobility 2600 anchor and the mobile access gateway. 2602 On most operating systems, a tunnel is implemented as a virtual 2603 point-to-point interface. The source and the destination address of 2604 the two end points of this virtual interface along with the 2605 encapsulation mode are specified for this virtual interface. Any 2606 packet that is routed over this interface gets encapsulated with the 2607 outer header as specified for that point to point tunnel interface. 2609 For creating a point to point tunnel to any local mobility anchor, 2610 the mobile access gateway may implement a tunnel interface with the 2611 source address field set to a global address on its egress interface 2612 (Proxy-CoA) and the destination address field set to the global 2613 address of the local mobility anchor (LMAA). 2615 The following is the supported packet encapsulation mode that can be 2616 used by the mobile access gateway and the local mobility anchor for 2617 routing mobile node's IPv6 datagrams. 2619 o IPv6-In-IPv6 - IPv6 datagram encapsulated in an IPv6 packet [RFC- 2620 2473]. 2622 The companion document [ID-IPV4-PMIP6] specifies other encapsulation 2623 modes for supporting IPv4 transport. 2625 o IPv6-In-IPv4 - IPv6 datagram encapsulation in an IPv4 packet. The 2626 details on how this mode is negotiated is specified in [ID-IPV4- 2627 PMIP6]. 2629 o IPv6-In-IPv4-UDP - IPv6 datagram encapsulation in an IPv4 UDP 2630 packet. This mode is specified in [ID-IPV4-PMIP6]. 2632 o IPv6-In-IPv4-UDP-TLV - IPv6 datagram encapsulation in an IPv4 UDP 2633 packet with a TLV header. This mode is specified in [ID-IPV4- 2634 PMIP6]. 2636 6.10.3. Local Routing 2638 If there is data traffic between a visiting mobile node and a 2639 correspondent node that is locally attached to an access link 2640 connected to the mobile access gateway, the mobile access gateway MAY 2641 optimize on the delivery efforts by locally routing the packets and 2642 by not reverse tunneling them to the mobile node's local mobility 2643 anchor. The flag EnableMAGLocalRouting MAY be used for controlling 2644 this behavior. However, in some systems, this may have an 2645 implication on the mobile node's accounting and policy enforcement as 2646 the local mobility anchor is not in the path for that traffic and it 2647 will not be able to apply any traffic policies or do any accounting 2648 for those flows. 2650 This decision of path optimization SHOULD be based on the policy 2651 configured on the mobile access gateway, but enforced by the mobile 2652 node's local mobility anchor. The specific details on how this is 2653 achieved are beyond of the scope of this document. 2655 6.10.4. Tunnel Management 2657 All the considerations mentioned in Section 5.6.1 for the tunnel 2658 management on the local mobility anchor apply for the mobile access 2659 gateway as well. 2661 6.10.5. Forwarding Rules 2663 Forwarding Packets sent to the Mobile Node's Home Network: 2665 o On receiving a packet from the bi-directional tunnel established 2666 with the mobile node's local mobility anchor, the mobile access 2667 gateway MUST use the destination address of the inner packet for 2668 forwarding it on the interface where the destination network 2669 prefix is hosted. The mobile access gateway MUST remove the outer 2670 header before forwarding the packet. Considerations from [RFC- 2671 2473] MUST be applied for IPv6 decapsulation. If the mobile 2672 access gateway cannot find the connected interface for that 2673 destination address, it MUST silently drop the packet. For 2674 reporting an error in such a scenario, in the form of ICMP control 2675 message, the considerations from [RFC-2473] MUST be applied. 2677 o On receiving a packet from a correspondent node that is locally 2678 connected and which is destined to a mobile node that is on 2679 another locally connected access link, the mobile access gateway 2680 MUST check the flag EnableMAGLocalRouting, to ensure the mobile 2681 access gateway is allowed to route the packet directly to the 2682 mobile node. If the mobile access gateway is not allowed to route 2683 the packet directly, it MUST route the packet through the bi- 2684 directional tunnel established between itself and the mobile 2685 node's local mobility anchor. Otherwise, it can route the packet 2686 directly to the mobile node. 2688 Forwarding Packets Sent by the Mobile Node: 2690 o On receiving a packet from a mobile node connected to its access 2691 link, the mobile access gateway MUST ensure that there is an 2692 established binding for that mobile node with its local mobility 2693 anchor before forwarding the packet directly to the destination or 2694 before tunneling the packet to the mobile node's local mobility 2695 anchor. 2697 o On receiving a packet from a mobile node connected to its access 2698 link for a destination that is locally connected, the mobile 2699 access gateway MUST check the flag EnableMAGLocalRouting, to 2700 ensure the mobile access gateway is allowed to route the packet 2701 directly to the destination. If the mobile access gateway is not 2702 allowed to route the packet directly, it MUST route the packet 2703 through the bi-directional tunnel established between itself and 2704 the mobile node's local mobility anchor. Otherwise, it MUST route 2705 the packet directly to the destination. 2707 o On receiving a packet from a mobile node connected to its access 2708 link, to a destination that is not directly connected, the packet 2709 MUST be forwarded to the local mobility anchor through the bi- 2710 directional tunnel established between itself and the mobile 2711 node's local mobility anchor. However, the packets that are sent 2712 with the link-local source address MUST NOT be forwarded. 2714 o The format of the tunneled packet is shown below. Considerations 2715 from [RFC-2473] MUST be applied for IPv6 encapsulation. However, 2716 when using IPv4 transport, the format of the tunneled packet is as 2717 described in [ID-IPV4-PMIP6]. 2719 IPv6 header (src= Proxy-CoA, dst= LMAA /* Tunnel Header */ 2720 IPv6 header (src= MN-HoA, dst= CN ) /* Packet Header */ 2721 Upper layer protocols /* Packet Content*/ 2723 Figure 14: Tunneled Packet from MAG to LMA 2725 o The format of the tunneled packet is shown below, when payload 2726 protection using IPsec is enabled for the mobile node's data 2727 traffic. However, when using IPv4 transport, the format of the 2728 packet is as described in [ID-IPV4-PMIP6]. 2730 IPv6 header (src= Proxy-CoA, dst= LMAA /* Tunnel Header */ 2731 ESP Header in tunnel mode /* ESP Header */ 2732 IPv6 header (src= MN-HoA, dst= CN ) /* Packet Header */ 2733 Upper layer protocols /* Packet Content*/ 2735 Figure 15: Tunneled Packet from MAG to LMA with Payload Protection 2737 6.11. Supporting DHCPv6 based Address Configuration on the Access Link 2739 This section explains how Stateful Address Configuration using DHCPv6 2740 can be enabled on the point-to-point link between the mobile node and 2741 the mobile access gateway and how a mobile node attached to that link 2742 can obtain an address from its home network prefix and using DHCPv6. 2744 o For supporting Stateful Address Configuration using DHCPv6, the 2745 DHCPv6 relay agent [RFC-3315] service MUST be configured on each 2746 of the mobile access gateways in the Proxy Mobile IPv6 domain. 2747 Further, as specified in Section 20 of [RFC-3315], the DHCPv6 2748 relay agent should be configured to use a list of destination 2749 addresses, which MAY include unicast addresses, the 2750 All_DHCP_Servers multicast address, or other addresses selected by 2751 the network administrator. 2753 o The DHCPv6 server in the Proxy Mobile IPv6 domain MUST be 2754 configured with prefix groups, One Prefix Group: ([P1], [P2], .. , 2755 [Pn]), Two Prefix Group: ([P5,P6], [P7,P8] .. [Pm-1, Pm]. Each 2756 of the entries represent a link on which the prefix(es) are 2757 hosted. The local mobility anchor(s) will assign all the 2758 prefix(es) under a given entry to a mobile node's interface. The 2759 prefixes under a given entry always go as a group and cannot be 2760 mixed in any order and can only be assigned to only one mobile 2761 node's interface. If the Proxy Mobile IPv6 domain support only 2762 single prefix for a given mobile node's interface, then the DHCPv6 2763 server need to maintain just one group of single prefixes. 2765 o The DHCPv6 server will not know the relation between the 2766 prefix(es) listed under an entry and a mobile node to which the 2767 corresponding prefixes are allocated. It just views these 2768 prefixes as hosted prefixes on a given link in that domain. Based 2769 on the prefix value present in the link-address option of the 2770 received DHCPv6 request, the DHCPv6 server assigns addresses from 2771 all of the prefixes associated with that link, 2773 o When a mobile node sends a DHCPv6 request message, the DHCPv6 2774 relay agent function on the mobile access gateway will set the 2775 link-address field in the DHCPv6 message to an address in the 2776 mobile node's home network prefix (any one of the mobile node's 2777 home network prefix assigned to that mobile node's attached 2778 interface). The address is generated as per [RFC-4862] by 2779 combining that mobile node's home network prefix and its own 2780 interface identifier on the access link shared with the mobile 2781 node, so as to provide a hint to the DHCPv6 Server for the link 2782 identification. The DHCPv6 server on receiving the request from 2783 the mobile node, will allocate address(es) from the prefixes 2784 associated with that link (identified using the link-address field 2785 of the request). 2787 o Once the mobile node obtains address(es) and moves to a different 2788 link and sends a DHCPv6 request (at any time) for extending the 2789 DHCP lease, the DHCPv6 relay agent on the new link will set the 2790 prefix hint in the DHCPv6 message to one of the mobile node's home 2791 network prefix (assigned by the local mobility anchor for this 2792 mobility session). The DHCPv6 server will identify the client 2793 from the Client-DUID option present in the request and will 2794 allocate the same address(es) as before. 2796 o The DHCPv6 based address configuration is not recommended for 2797 deployments where the local mobility anchor and the mobile access 2798 gateways are located in different administrative domains. For 2799 this configuration to work, all the mobile access gateways in the 2800 Proxy Mobile IPv6 domain should be able to ensure that the DHCPv6 2801 request messages from a given mobile node anchored on any of the 2802 access links in that domain, will always be handled by the same 2803 DHCPv6 server or by a server from the same group of coordinated 2804 DHCPv6 servers serving that domain. 2806 o The DHCPv6 server should be configured to offer low address lease 2807 times. A lease time that is too large prevents the DHCPv6 server 2808 from reclaiming the address even after the local mobility anchor 2809 deletes the mobile node's binding cache entry. It is recommended 2810 that the configured lease time be lower than the accepted binding 2811 lifetime for any mobility binding. 2813 6.12. Home Network Prefix Renumbering 2815 If the mobile node's home network prefix(es) gets renumbered or 2816 becomes invalid during the middle of a mobility session, the mobile 2817 access gateway MUST withdraw the prefix(es) by sending a Router 2818 Advertisement message on the access link with zero prefix lifetime 2819 for the prefix(es) that is being renumbered. Also, the local 2820 mobility anchor and the mobile access gateway MUST delete the created 2821 routing state for the renumbered prefix(es). However, the specific 2822 details on how the local mobility anchor notifies the mobile access 2823 gateway about the mobile node's home network prefix(es) renumbering 2824 are outside the scope of this document. 2826 6.13. Mobile Node Detachment Detection and Resource Cleanup 2828 Before sending a Proxy Binding Update message to the local mobility 2829 anchor for extending the lifetime of a currently existing binding of 2830 a mobile node, the mobile access gateway MUST make sure the mobile 2831 node is still attached to the connected link by using some reliable 2832 method. If the mobile access gateway cannot predictably detect the 2833 presence of the mobile node on the connected link, it MUST NOT 2834 attempt to extend the registration lifetime of the mobile node. 2835 Further, in such a scenario, the mobile access gateway SHOULD 2836 terminate the binding of the mobile node by sending a Proxy Binding 2837 Update message to the mobile node's local mobility anchor with 2838 lifetime value set to 0. It MUST also remove any local state such as 2839 the Binding Update List entry created for that mobile node. 2841 The specific detection mechanism of the loss of a visiting mobile 2842 node on the connected link is specific to the access link between the 2843 mobile node and the mobile access gateway and is outside the scope of 2844 this document. Typically, there are various link-layer specific 2845 events specific to each access technology that the mobile access 2846 gateway can depend on for detecting the node loss. In general, the 2847 mobile access gateway can depend on one or more of the following 2848 methods for the detection presence of the mobile node on the 2849 connected link: 2851 o Link-layer event specific to the access technology 2853 o PPP Session termination event on point-to-point link types 2855 o IPv6 Neighbor Unreachability Detection event from IPv6 stack 2857 o Notification event from the local mobility anchor 2859 6.14. Allowing network access to other IPv6 nodes 2861 In some Proxy Mobile IPv6 deployments, network operators may want to 2862 provision the mobile access gateway to offer network-based mobility 2863 management service only to some visiting mobile nodes and enable just 2864 regular IP access to some other nodes. This requires the network to 2865 have control on when to enable network-based mobility management 2866 service to a mobile node and when to enable regular IPv6 access. 2867 This specification does not disallow such configuration. 2869 Upon detecting a mobile node on its access link and after policy 2870 considerations, the mobile access gateway MUST determine if network- 2871 based mobility management service should be offered to that mobile 2872 node. If the mobile node is entitled for network-based mobility 2873 management service, then the mobile access gateway must ensure the 2874 mobile node believes it is on its home link, as explained in various 2875 sections of this specification. 2877 If the mobile node is not entitled for the network-based mobility 2878 management service, as determined from the policy considerations, the 2879 mobile access gateway MAY choose to offer regular IPv6 access to the 2880 mobile node and in such a scenario the normal IPv6 considerations 2881 apply. If IPv6 access is enabled, the mobile node SHOULD be able to 2882 obtain IPv6 address(es) using the normal IPv6 address configuration 2883 procedures. The obtained address(es) must be from a local visitor 2884 network prefix(es). This essentially ensures that the mobile access 2885 gateway functions as a normal access router to a mobile node attached 2886 to its access link and without impacting its host-based mobility 2887 protocol operation. 2889 7. Mobile Node Operation 2891 This non-normative section explains the mobile node's operation in a 2892 Proxy Mobile IPv6 domain. 2894 7.1. Moving into a Proxy Mobile IPv6 Domain 2896 When a mobile node enters a Proxy Mobile IPv6 domain and attaches to 2897 an access network, the mobile access gateway on the access link 2898 detects the attachment of the mobile node and completes the binding 2899 registration with the mobile node's local mobility anchor. If the 2900 binding update operation is successfully performed, the mobile access 2901 gateway will create the required state and set up the data path for 2902 the mobile node's data traffic. 2904 If the mobile node is IPv6 enabled, on attaching to the access link, 2905 it will typically send a Router Solicitation message [RFC-4861]. The 2906 mobile access gateway on the access link will respond to the Router 2907 Solicitation message with a Router Advertisement message. The Router 2908 Advertisement message will carry the mobile node's home network 2909 prefix(es), default-router address and other address configuration 2910 Parameters. 2912 If the mobile access gateway on the access link receives a Router 2913 Solicitation message from the mobile node, before it completes the 2914 signaling with the mobile node's local mobility anchor, the mobile 2915 access gateway may not know the mobile node's home network prefix(es) 2916 and may not be able to emulate the mobile node's home link on the 2917 access link. In such a scenario, the mobile node may notice a slight 2918 delay before it receives a Router Advertisement message. 2920 If the received Router Advertisement message has the Managed Address 2921 Configuration flag set, the mobile node, as it would normally do, 2922 will send a DHCPv6 Request [RFC-3315]. The DHCP relay service 2923 enabled on that access link will ensure the mobile node can obtain 2924 one or more addresses and from its home network prefix(es). 2926 If the received Router Advertisement message does not have the 2927 Managed Address Configuration flag set and if the mobile node is 2928 allowed to use autoconfigured address(es), the mobile node will be 2929 able to obtain IPv6 address(es) and from each of its home network 2930 prefixes using any of the standard IPv6 address configuration 2931 mechanisms permitted for that mode. 2933 If the mobile node is IPv4 enabled and if the network permits, it 2934 will be able to obtain the IPv4 address configuration as specified in 2935 the companion document [ID-IPV4-PMIP6]. 2937 Once the address configuration is complete, the mobile node can 2938 continue to use this address configuration as long as it is attached 2939 to the network that is in the scope of that Proxy Mobile IPv6 domain. 2941 7.2. Roaming in the Proxy Mobile IPv6 Domain 2943 After obtaining the address configuration in the Proxy Mobile IPv6 2944 domain, as the mobile node moves and changes its point of attachment 2945 from one mobile access gateway to the other, it can still continue to 2946 use the same address configuration. As long as the attached access 2947 link is in the scope of that Proxy Mobile IPv6 domain, the mobile 2948 node will always detect the same default-router advertising the 2949 mobile node's home network prefix(es) on each connected link. If the 2950 mobile node has address configuration that it obtained using DHCPv6, 2951 it will be able to retain the address configuration and extend the 2952 lease lifetime. 2954 8. Message Formats 2956 This section defines extensions to the Mobile IPv6 [RFC-3775] 2957 protocol messages. 2959 8.1. Proxy Binding Update Message 2961 0 1 2 3 2962 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2963 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2964 | Sequence # | 2965 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2966 |A|H|L|K|M|R|P| Reserved | Lifetime | 2967 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2968 | | 2969 . . 2970 . Mobility options . 2971 . . 2973 | | 2974 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2976 A Binding Update message that is sent by a mobile access gateway to a 2977 local mobility anchor is referred to as the "Proxy Binding Update" 2978 message. A new flag (P) is included in the Binding Update message. 2979 The rest of the Binding Update message format remains the same as 2980 defined in [RFC-3775] and with the additional (R) and (M) flags as 2981 specified in [RFC-3963] and [RFC-4140] respectively. 2983 Proxy Registration Flag (P) 2985 A new flag (P) is included in the Binding Update message to 2986 indicate to the local mobility anchor that the Binding Update 2987 message is a proxy registration. The flag MUST be set to the 2988 value of 1 for proxy registrations and MUST be set to 0 for direct 2989 registrations sent by a mobile node. 2991 Mobility Options 2993 Variable-length field of such length that the complete Mobility 2994 Header is an integer multiple of 8 octets long. This field 2995 contains zero or more TLV-encoded mobility options. The encoding 2996 and format of defined options are described in Section 6.2 of 2997 [RFC-3775]. The local mobility anchor MUST ignore and skip any 2998 options which it does not understand. 3000 As per this specification, the following mobility options are 3001 valid in a Proxy Binding Update message. These options can be 3002 present in the message in any order. There can be one or more 3003 instances of the Home Network Prefix options present in the 3004 message. However, there cannot be more than one instance of any 3005 of the other options. 3007 Mobile Node Identifier option 3009 Home Network Prefix option 3011 Handoff Indicator option 3013 Access Technology Type option 3015 Timestamp option 3017 Mobile Node Link-layer Identifier option 3019 Link-local Address option 3021 Additionally, there can one or more instances of the Vendor- 3022 Specific Mobility option [RFC-5094]. 3024 For descriptions of other fields present in this message, refer to 3025 section 6.1.7 of [RFC-3775]. 3027 8.2. Proxy Binding Acknowledgement Message 3029 0 1 2 3 3030 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 3031 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3032 | Status |K|R|P|Reserved | 3033 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3034 | Sequence # | Lifetime | 3035 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3036 | | 3037 . . 3038 . Mobility options . 3039 . . 3040 | | 3041 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3043 A Binding Acknowledgement message that is sent by a local mobility 3044 anchor to a mobile access gateway is referred to as the "Proxy 3045 Binding Acknowledgement" message. A new flag (P) is included in the 3046 Binding Acknowledgement message. The rest of the Binding 3047 Acknowledgement message format remains the same as defined in [RFC- 3048 3775] and with the additional (R) flag as specified in [RFC-3963]. 3050 Proxy Registration Flag (P) 3052 A new flag (P) is included in the Binding Acknowledgement message 3053 to indicate that the local mobility anchor that processed the 3054 corresponding Proxy Binding Update message supports proxy 3055 registrations. The flag is set to value of 1 only if the 3056 corresponding Proxy Binding Update had the Proxy Registration Flag 3057 (P) set to value of 1. 3059 Mobility Options 3061 Variable-length field of such length that the complete Mobility 3062 Header is an integer multiple of 8 octets long. This field 3063 contains zero or more TLV-encoded mobility options. The encoding 3064 and format of defined options are described in Section 6.2 of 3065 [RFC-3775]. The mobile access gateway MUST ignore and skip any 3066 options which it does not understand. 3068 As per this specification, the following mobility options are 3069 valid in a Proxy Binding Acknowledgement message. These options 3070 can be present in the message in any order. There can be one or 3071 more instances of the Home Network Prefix options present in the 3072 message. However, there cannot be more than one instance of any 3073 of the other options. 3075 Mobile Node Identifier option 3077 Home Network Prefix option 3079 Handoff Indicator option 3081 Access Technology Type option 3083 Timestamp option 3085 Mobile Node Link-layer Identifier option 3087 Link-local Address option 3089 Additionally, there can one or more instances of the Vendor- 3090 Specific Mobility option [RFC-5094]. 3092 Status 3094 8-bit unsigned integer indicating the disposition of the Proxy 3095 Binding Update. Values of the Status field less than 128 indicate 3096 that the Proxy Binding Update was accepted by the local mobility 3097 anchor. Values greater than or equal to 128 indicate that the 3098 binding registration was rejected by the local mobility anchor. 3099 Section 8.9 defines the Status values that can used in Proxy 3100 Binding Acknowledgement message. 3102 For descriptions of other fields present in this message, refer to 3103 the section 6.1.8 of [RFC-3775]. 3105 8.3. Home Network Prefix Option 3107 A new option, Home Network Prefix Option is defined for using it in 3108 the Proxy Binding Update and Proxy Binding Acknowledgement messages 3109 exchanged between a local mobility anchor and a mobile access 3110 gateway. This option is used for exchanging the mobile node's home 3111 network prefix information. There can be multiple Home Network 3112 Prefix options present in the message. 3114 The Home Network Prefix Option has an alignment requirement of 8n+4. 3115 Its format is as follows: 3117 0 1 2 3 3118 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 3119 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3120 | Type | Length | Reserved | Prefix Length | 3121 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3122 | | 3123 + + 3124 | | 3125 + Home Network Prefix + 3126 | | 3127 + + 3128 | | 3129 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3131 Type 3132 3134 Length 3136 8-bit unsigned integer indicating the length of the option 3137 in octets, excluding the type and length fields. This field 3138 MUST be set to 18. 3140 Reserved (R) 3142 This 8-bit field is unused for now. The value MUST be 3143 initialized to 0 by the sender and MUST be ignored by the 3144 receiver. 3146 Prefix Length 3148 8-bit unsigned integer indicating the prefix length of the 3149 IPv6 prefix contained in the option. 3151 Home Network Prefix 3153 A sixteen-byte field containing the mobile node's IPv6 Home 3154 Network Prefix. 3156 8.4. Handoff Indicator Option 3158 A new option, Handoff Indicator Option is defined for using it in the 3159 Proxy Binding Update and Proxy Binding Acknowledgement messages 3160 exchanged between a local mobility anchor and a mobile access 3161 gateway. This option is used for exchanging the mobile node's 3162 handoff related hints. 3164 The Handoff Indicator Option has no alignment requirement. Its 3165 format is as follows: 3167 0 1 2 3 3168 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 3169 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3170 | Type | Length | Reserved (R) | HI | 3171 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3173 Type 3174 3176 Length 3178 8-bit unsigned integer indicating the length of the option 3179 in octets, excluding the type and length fields. This field 3180 MUST be set to 2. 3182 Reserved (R) 3184 This 8-bit field is unused for now. The value MUST be 3185 initialized to 0 by the sender and MUST be ignored by the 3186 receiver. 3188 Handoff Indicator (HI) 3190 A 8-bit field that specifies the type of handoff. The values 3191 (0 - 255) will be allocated and managed by IANA. The following 3192 values are currently defined. 3194 0: Reserved 3195 1: Attachment over a new interface 3196 2: Handoff between two different interfaces of the mobile node 3197 3: Handoff between mobile access gateways for the same interface 3198 4: Handoff state unknown 3199 5: Handoff state not changed (Re-registration) 3201 8.5. Access Technology Type Option 3203 A new option, Access Technology Type Option is defined for using it 3204 in the Proxy Binding Update and Proxy Binding Acknowledgement 3205 messages exchanged between a local mobility anchor and a mobile 3206 access gateway. This option is used for exchanging the type of the 3207 access technology using which the mobile node is currently attached 3208 to the mobile access gateway. 3210 The Access Technology Type Option has no alignment requirement. Its 3211 format is as follows: 3213 0 1 2 3 3214 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 3215 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3216 | Type | Length | Reserved (R) | ATT | 3217 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3219 Type 3220 3222 Length 3224 8-bit unsigned integer indicating the length of the option 3225 in octets, excluding the type and length fields. This field 3226 MUST be set to 2. 3228 Reserved (R) 3230 This 8-bit field is unused for now. The value MUST be 3231 initialized to 0 by the sender and MUST be ignored by the 3232 receiver. 3234 Access Technology Type (ATT) 3236 A 8-bit field that specifies the access technology through 3237 which the mobile node is connected to the access link on the 3238 mobile access gateway. 3240 The values (0 - 255) will be allocated and managed by IANA. The 3241 following values are currently reserved for the below specified 3242 access technology types. 3244 0: Reserved ("Reserved") 3245 1: Virtual ("Logical Network Interface") 3246 2: PPP ("Point-to-Point Protocol") 3247 3: IEEE 802.3 ("Ethernet") 3248 4: IEEE 802.11a/b/g ("Wireless LAN") 3249 5: IEEE 802.16e ("WIMAX") 3251 8.6. Mobile Node Link-layer Identifier Option 3253 A new option, Mobile Node Link-layer Identifier Option is defined for 3254 using it in the Proxy Binding Update and Proxy Binding 3255 Acknowledgement messages exchanged between a local mobility anchor 3256 and a mobile access gateway. This option is used for exchanging the 3257 mobile node's link-layer identifier. 3259 The format of the Link-layer Identifier option is shown below. Based 3260 on the size of the identifier, the option MUST be aligned 3261 appropriately, as per mobility option alignment requirements 3262 specified in [RFC-3775]. 3264 0 1 2 3 3265 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 3266 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3267 | Type | Length | Reserved | 3268 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3269 | | 3270 + Link-layer Identifier + 3271 . ... . 3272 | | 3273 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3275 Type 3276 3278 Length 3279 8-bit unsigned integer indicating the length of the option 3280 in octets, excluding the type and length fields. 3282 Reserved 3284 This field is unused for now. The value MUST be initialized to 3285 0 by the sender and MUST be ignored by the receiver. 3287 Link-layer Identifier 3289 A variable length field containing the mobile node's link-layer 3290 identifier. 3292 The content and format of this field (including byte and bit 3293 ordering) is as specified in Section 4.6 of [RFC-4861] for 3294 carrying Link-Layer Address. On certain access links, where 3295 the link-layer address is not used or cannot be determined, 3296 this option cannot be used. 3298 8.7. Link-local Address Option 3300 A new option, Link-local Address Option is defined for using it in 3301 the Proxy Binding Update and Proxy Binding Acknowledgement messages 3302 exchanged between a local mobility anchor and a mobile access 3303 gateway. This option is used for exchanging the link-local address 3304 of the mobile access gateway. 3306 The Link-local Address option has an alignment requirement of 8n+6. 3307 Its format is as follows: 3309 0 1 2 3 3310 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 3311 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3312 | Type | Length | 3313 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3314 | | 3315 + + 3316 | | 3317 + Link-local Address + 3318 | | 3319 + + 3320 | | 3321 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3323 Type 3324 3326 Length 3328 8-bit unsigned integer indicating the length of the option 3329 in octets, excluding the type and length fields. This field 3330 MUST be set to 16. 3332 Link-local Address 3334 A sixteen-byte field containing the mobile node's link-local 3335 address. 3337 8.8. Timestamp Option 3339 A new option, Timestamp Option is defined for use in the Proxy 3340 Binding Update and Proxy Binding Acknowledgement messages. 3342 The Timestamp option has an alignment requirement of 8n+2. Its 3343 format is as follows: 3345 0 1 2 3 3346 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 3347 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3348 | Type | Length | 3349 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3350 | | 3351 + Timestamp + 3352 | | 3353 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3355 Type 3356 3358 Length 3360 8-bit unsigned integer indicating the length in octets of 3361 the option, excluding the type and length fields. The value 3362 for this field MUST be set to 8. 3364 Timestamp 3366 A 64-bit unsigned integer field containing a timestamp. The value 3367 indicates the number of seconds since January 1, 1970, 00:00 UTC, 3368 by using a fixed point format. In this format, the integer number 3369 of seconds is contained in the first 48 bits of the field, and the 3370 remaining 16 bits indicate the number of 1/65536 fractions of a 3371 second. 3373 8.9. Status Values 3375 This document defines the following new Status values for use in 3376 Proxy Binding Acknowledgement message. These values are to be 3377 allocated from the same number space, as defined in Section 6.1.8 of 3378 [RFC-3775]. 3380 Status values less than 128 indicate that the Proxy Binding Update 3381 request was accepted by the local mobility anchor. Status values 3382 greater than 128 indicate that the Proxy Binding Update was rejected 3383 by the local mobility anchor. 3385 PROXY_REG_NOT_ENABLED: IANA 3387 Proxy registration not enabled for the mobile node 3389 NOT_LMA_FOR_THIS_MOBILE_NODE: IANA 3391 Not local mobility anchor for this mobile node 3393 MAG_NOT_AUTHORIZED_FOR_PROXY_REG: IANA 3395 The mobile access gateway is not authorized to send proxy binding 3396 registrations 3398 NOT_AUTHORIZED_FOR_HOME_NETWORK_PREFIX: IANA 3400 The mobile node is not authorized for one or more of the 3401 requesting home network prefixes. 3403 TIMESTAMP_MISMATCH: IANA 3405 Invalid timestamp value (the clocks are out of sync) 3407 TIMESTAMP_LOWER_THAN_PREV_ACCEPTED: IANA 3409 The timestamp value is lower than the previously accepted value 3411 MISSING_HOME_NETWORK_PREFIX_OPTION: IANA 3413 Missing home network prefix option 3415 MISSING_MN_IDENTIFIER_OPTION: IANA 3417 Missing mobile node identifier option 3419 MISSING_HANDOFF_INDICATOR_OPTION: IANA 3420 Missing handoff indicator option 3422 MISSING_ACCESS_TECH_TYPE_OPTION: IANA 3424 Missing access technology type option 3426 Additionally, the following Status values defined in [RFC-3775] can 3427 also be used in Proxy Binding Acknowledgement message. 3429 0 Proxy Binding Update accepted 3431 128 Reason unspecified 3433 129 Administratively prohibited 3435 130 Insufficient resources 3437 9. Protocol Configuration Variables 3439 9.1. Local Mobility Anchor - Configuration Variables 3441 The local mobility anchor MUST allow the following variables to be 3442 configured by the system management. The configured values for these 3443 protocol variables MUST survive server reboots and service restarts. 3445 MinDelayBeforeBCEDelete 3447 This variable specifies the amount of time in milliseconds the 3448 local mobility anchor MUST wait before it deletes a Binding Cache 3449 entry of a mobile node, upon receiving a Proxy Binding Update 3450 message from a mobile access gateway with a lifetime value of 0. 3451 During this wait time, if the local mobility anchor receives a 3452 Proxy Binding Update for the same mobility binding, with lifetime 3453 value greater than 0, then it must update the binding cache entry 3454 with the accepted binding values. By the end of this wait-time, 3455 if the local mobility anchor did not receive any valid Proxy 3456 Binding Update message for that mobility binding, it MUST delete 3457 the Binding Cache entry. This delay essentially ensures a mobile 3458 node's Binding Cache entry is not deleted too quickly and allows 3459 some time for the new mobile access gateway to complete the 3460 signaling for the mobile node. 3462 The default value for this variable is 10000 milliseconds. 3464 MaxDelayBeforeNewBCEAssign 3466 This variable specifies the amount of time in milliseconds the 3467 local mobility anchor MUST wait for the de-registration message 3468 for an existing mobility session before it decides to create a new 3469 mobility session. 3471 The default value for this variable is 500 milliseconds. 3473 TimestampValidityWindow 3475 This variable specifies the maximum amount of time difference in 3476 milliseconds between the timestamp in the received Proxy Binding 3477 Update message and the current time-of-day on the local mobility 3478 anchor, that is allowed by the local mobility anchor for the 3479 received message to be considered valid. 3481 The default value for this variable is 300 milliseconds. This 3482 variable must be adjusted to suit the deployments. 3484 9.2. Mobile Access Gateway - Configuration Variables 3486 The mobile access gateway MUST allow the following variables to be 3487 configured by the system management. The configured values for these 3488 protocol variables MUST survive server reboots and service restarts. 3490 EnableMAGLocalRouting 3492 This flag indicates whether or not the mobile access gateway is 3493 allowed to enable local routing of the traffic exchanged between a 3494 visiting mobile node and a correspondent node that is locally 3495 connected to one of the interfaces of the mobile access gateway. 3496 The correspondent node can be another visiting mobile node as 3497 well, or a local fixed node. 3499 The default value for this flag is set to value of 0, indicating 3500 that the mobile access gateway MUST reverse tunnel all the traffic 3501 to the mobile node's local mobility anchor. 3503 When the value of this flag is set to value of 1, the mobile 3504 access gateway MUST route the traffic locally. 3506 This aspect of local routing MAY be defined as policy on a per 3507 mobile basis and when present will take precedence over this flag. 3509 9.3. Proxy Mobile IPv6 Domain - Configuration Variables 3511 All the mobile entities (local mobility anchors and mobile access 3512 gateways in a Proxy Mobile IPv6 domain MUST allow the following 3513 variables to be configured by the system management. The configured 3514 values for these protocol variables MUST survive server reboots and 3515 service restarts. These variables MUST be globally fixed for a given 3516 Proxy Mobile IPv6 domain resulting in the same values being enforced 3517 on all the mobility entities in that domain. 3519 MobileNodeGeneratedTimestampInUse 3521 This flag indicates whether or not the mobile node generated 3522 timestamp mechanism is in use in that Proxy Mobile IPv6 domain. 3523 When the value for this flag is set to 1, the local mobility 3524 anchors and mobile access gateways in that Proxy Mobile IPv6 3525 domain MUST apply the mobile node generated timestamp 3526 considerations. 3528 The default value for this flag is set to value of 0, indicating 3529 that the mobile node generated timestamp mechanism is not in use 3530 in that Proxy Mobile IPv6 domain. 3532 10. IANA Considerations 3534 This document defines six new Mobility Header options, the Home 3535 Network Prefix option, Handoff Indicator option, Access Technology 3536 Type option, Mobile Node Link-layer Identifier option, Link-local 3537 Address option and Timestamp option. These options are described in 3538 Section 8. The Type value for these options needs to be assigned 3539 from the same numbering space as allocated for the other mobility 3540 options, as defined in [RFC-3775]. 3542 The Handoff Indicator option defined in Section 8.4 of this document 3543 introduces a new Handoff Indicator (HI) numbering space, where the 3544 values from 0 to 5 have been reserved by this document. Approval of 3545 new Handoff Indicator type values are to be made through IANA Expert 3546 Review. 3548 The Access Technology Type option defined in Section 8.5 of this 3549 document introduces a new Access Technology type (ATT) numbering 3550 space, where the values from 0 to 5 have been reserved by this 3551 document. Approval of new Access Technology type values are to be 3552 made through IANA Expert Review. 3554 This document also defines new Binding Acknowledgement status values 3555 as described in Section 8.9. The status values MUST be assigned from 3556 the same number space used for Binding Acknowledgement status values, 3557 as defined in [RFC-3775]. The allocated values for each of these 3558 status values must be greater than 128. 3560 11. Security Considerations 3562 The potential security threats against any network-based mobility 3563 management protocol are described in [RFC-4832]. This section 3564 explains how Proxy Mobile IPv6 protocol defends itself against those 3565 threats. 3567 Proxy Mobile IPv6 protocol requires the signaling messages, Proxy 3568 Binding Update and Proxy Binding Acknowledgement, exchanged between 3569 the mobile access gateway and the local mobility anchor to be 3570 protected using IPsec, using the established security association 3571 between them. This essentially eliminates the threats related to the 3572 impersonation of the mobile access gateway or the local mobility 3573 anchor. 3575 This specification allows a mobile access gateway to send binding 3576 registration messages on behalf of a mobile node. If proper 3577 authorization checks are not in place, a malicious node may be able 3578 to hijack a mobile node's session or may carry out a denial-of- 3579 service attack. To prevent this attack, this specification requires 3580 the local mobility anchor to allow only authorized mobile access 3581 gateways that are part of that Proxy Mobile IPv6 domain to send 3582 binding registration messages on behalf of a mobile node. 3584 To eliminate the threats on the interface between the mobile access 3585 gateway and the mobile node, this specification requires an 3586 established trust between the mobile access gateway and the mobile 3587 node and to authenticate and authorize the mobile node before it is 3588 allowed to access the network. Further, the established 3589 authentication mechanisms enabled on that access link will ensure 3590 that there is a secure binding between the mobile node's identity and 3591 its link-layer address. The mobile access gateway will definitively 3592 identify the mobile node from the packets that it receives on that 3593 access link. 3595 To address the threat related to a compromised mobile access gateway, 3596 the local mobility anchor, before accepting a Proxy Binding Update 3597 message for a given mobile node, may ensure that the mobile node is 3598 definitively attached to the mobile access gateway that sent the 3599 proxy binding registration request. This may be accomplished by 3600 contacting a trusted entity which is able to track the mobile node's 3601 current point of attachment. However, the specific details of the 3602 actual mechanisms for achieving this is outside the scope of this 3603 document. 3605 12. Acknowledgements 3607 The authors would like to specially thank Jari Arkko, Julien 3608 Laganier, Christian Vogt, Dave Thaler, Pasi Eronen, Pete McCann, 3609 Brian Haley, Ahmad Muhanna, JinHyeock Choi and Elwyn Davies for their 3610 thorough review of this document. 3612 The authors would also like to thank Alex Petrescu, Alice Qinxia, 3613 Alper Yegin, Ashutosh Dutta, Behcet Sarikaya, Fred Templin, Genadi 3614 Velev, George Tsirtsis, Gerardo Giaretta, Henrik Levkowetz, Hesham 3615 Soliman, James Kempf, Jean-Michel Combes, Jun Awano, John Zhao, Jong- 3616 Hyouk Lee, Jonne Soininen, Jouni Korhonen, Kalin Getov, Kilian 3617 Weniger, Lars Eggert, Magnus Westerlund, Marco Liebsch, Mohamed 3618 Khalil, Nishida Katsutoshi, Phil Roberts, Ryuji Wakikawa, Sangjin 3619 Jeong, Suresh Krishnan, Uri Blumenthal, Ved Kafle, Vidya Narayanan, 3620 Youn-Hee Han and many others for their passionate discussions in the 3621 working group mailing list on the topic of localized mobility 3622 management solutions. These discussions stimulated much of the 3623 thinking and shaped the draft to the current form and we acknowledge 3624 that ! 3626 The authors would also like to thank Ole Troan, Akiko Hattori, Parviz 3627 Yegani, Mark Grayson, Michael Hammer, Vojislav Vucetic, Jay Iyer and 3628 Tim Stammers for their input on this document. 3630 13. References 3632 13.1. Normative References 3634 [RFC-2119] Bradner, S., "Key words for use in RFCs to Indicate 3635 Requirement Levels", BCP 14, RFC 2119, March 1997. 3637 [RFC-2473] Conta, A. and S. Deering, "Generic Packet Tunneling in 3638 IPv6 Specification", RFC 2473, December 1998. 3640 [RFC-3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C. and 3641 M.Carney, "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", 3642 RFC 3315, July 2003. 3644 [RFC-3775] Johnson, D., Perkins, C., Arkko, J., "Mobility Support in 3645 IPv6", RFC 3775, June 2004. 3647 [RFC-3963] Devarapalli, V., Wakikawa, R., Petrescu, A., and P. 3648 Thubert, "Network Mobility (NEMO) Basic Support Protocol", RFC 3963, 3649 January 2005. 3651 [RFC-4140] Soliman, H., Castelluccia, C., El Malki, K., and L. 3652 Bellier, "Hierarchical Mobile IPv6 Mobility Management (HMIPv6)", RFC 3653 4140, August 2005. 3655 [RFC-4282] Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The 3656 Network Access Identifier", RFC 4282, December 2005. 3658 [RFC-4283] Patel, A., Leung, K., Khalil, M., Akhtar, H., and K. 3659 Chowdhury, "Mobile Node Identifier Option for Mobile IPv6", RFC 4283, 3660 November 2005. 3662 [RFC-4291] Hinden, R., Deering, S., "IP Version 6 Addressing 3663 Architecture", RFC 4291, February 2006. 3665 [RFC-4301] Kent, S. and Atkinson, R., "Security Architecture for the 3666 Internet Protocol", RFC 4301, December 2005. 3668 [RFC-4303] Kent, S. "IP Encapsulating Security Protocol (ESP)", RFC 3669 4303, December 2005. 3671 [RFC-4861] Narten, T., Nordmark, E. and W. Simpson, Soliman, H., 3672 "Neighbor Discovery for IP Version 6 (IPv6)", RFC 4861, September 3673 2007. 3675 13.2. Informative References 3677 [RFC-1661] Simpson, W., Ed., "The Point-To-Point Protocol (PPP)", STD 3678 51, RFC 1661, July 1994. 3680 [RFC-1981] McCann, J., Deering, S., and J. Mogul, "Path MTU Discovery 3681 for IP version 6", RFC 1981, August 1996. 3683 [RFC-2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson, 3684 "Remote Authentication Dial In User Service (RADIUS)", RFC 2865, June 3685 2000. 3687 [RFC-3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J. 3688 Arkko, "Diameter Base Protocol", RFC 3588, September 2003. 3690 [RFC-3971] Arkko, J., Ed., Kempf, J., Sommerfeld, B., Zill, B., and 3691 P. Nikander, "SEcure Neighbor Discovery (SEND)", RFC 3971, March 3692 2005. 3694 [RFC-4306] Kaufman, C, et al, "Internet Key Exchange (IKEv2) 3695 Protocol", RFC 4306, December 2005. 3697 [RFC-4330] Mills, D., "Simple Network Time Protocol (SNTP) Version 4 3698 for IPv4, IPv6 and OSI", RFC 4330, October 1996. 3700 [RFC-4372] Adrangi, F., Lior, A., Korhonen, J., and J. Loughney, 3701 "Chargeable User Identity", RFC 4372, January 2006. 3703 [RFC-4821] Mathis, M. and Heffner, J., "Packetization Layer Path MTU 3704 Discovery", RFC 4821, March 2007. 3706 [RFC-4830] Kempf, J., Leung, K., Roberts, P., Nishida, K., Giaretta, 3707 G., Liebsch, M., "Problem Statement for Network-based Localized 3708 Mobility Management", September 2006. 3710 [RFC-4831] Kempf, J., Leung, K., Roberts, P., Nishida, K., Giaretta, 3711 G., Liebsch, M., "Goals for Network-based Localized Mobility 3712 Management", October 2006. 3714 [RFC-4832] Vogt, C., Kempf, J., "Security Threats to Network-Based 3715 Localized Mobility Management", September 2006. 3717 [RFC-4862] Thompson, S., Narten, T., Jinmei, T., "IPv6 Stateless 3718 Address Autoconfiguration", RFC 4862, September 2007. 3720 [RFC-4941] Narten, T., Draves, R., Krishnan, S., "Privacy Extensions 3721 for Stateless Address Autoconfiguration in IPv6", RFC 4941, September 3722 2007. 3724 [RFC-5094] Devarapalli, V., Leung, K. and Patel, A., "Mobile IPv6 3725 Vendor Specific Option", RFC 5094, December 2007. 3727 [ID-IPV4-PMIP6] Wakikawa, R. and Gundavelli, S., "IPv4 Support for 3728 Proxy Mobile IPv6", draft-ietf-netlmm-pmip6-ipv4-support-02.txt, 3729 November 2007. 3731 [ID-DNAV6] Narayanan, S., et al "Detecting Network Attachment in IPv6 3732 Networks (DNAv6)", draft-ietf-dna-protocol-07.txt, February 2008. 3734 Appendix A. Proxy Mobile IPv6 interactions with AAA Infrastructure 3736 Every mobile node that roams in a proxy Mobile IPv6 domain, would 3737 typically be identified by an identifier, MN-Identifier, and that 3738 identifier will have an associated policy profile that identifies the 3739 mobile node's home network prefix(es) on a per-interface basis, 3740 permitted address configuration modes, roaming policy and other 3741 parameters that are essential for providing network-based mobility 3742 management service. This information is typically configured in AAA. 3743 In some cases, the home network prefix(es) may be dynamically 3744 assigned to the mobile node's interface, after its initial attachment 3745 to the Proxy Mobile IPv6 domain over that interface and may not be 3746 configured in the mobile node's policy profile. 3748 The network entities in the proxy Mobile IPv6 domain, while serving a 3749 mobile node will have access to the mobile node's policy profile and 3750 these entities can query this information using RADIUS [RFC-2865] or 3751 DIAMETER [RFC-3588] protocols. 3753 Appendix B. Routing State 3755 The following section explains the routing state created for a mobile 3756 node on the mobile access gateway. This routing state reflects only 3757 one specific way of implementation and one MAY choose to implement it 3758 in other ways. The policy based route defined below acts as a 3759 traffic selection rule for routing a mobile node's traffic through a 3760 specific tunnel created between the mobile access gateway and that 3761 mobile node's local mobility anchor and with the specific 3762 encapsulation mode, as negotiated. 3764 The below example identifies the routing state for two visiting 3765 mobile nodes, MN1 and MN2 with their respective local mobility 3766 anchors LMA1 and LMA2. 3768 For all traffic from the mobile node, identified by the mobile node's 3769 MAC address, ingress interface or source prefix (MN-HNP) to 3770 _ANY_DESTINATION_ route via interface tunnel0, next-hop LMAA. 3772 +==================================================================+ 3773 | Packet Source | Destination Address | Destination Interface | 3774 +==================================================================+ 3775 | MAC_Address_MN1, | _ANY_DESTINATION_ | Tunnel0 | 3776 | (IPv6 Prefix or |----------------------------------------------| 3777 | Input Interface) | Locally Connected | Tunnel0 | 3778 +------------------------------------------------------------------+ 3779 | MAC_Address_MN2, | _ANY_DESTINATION_ | Tunnel1 | 3780 + (IPv6 Prefix or -----------------------------------------------| 3781 | Input Interface | Locally Connected | direct | 3782 +------------------------------------------------------------------+ 3783 Figure 24: Example - Policy based Route Table 3785 +==================================================================+ 3786 | Interface | Source Address | Destination Address | Encapsulation | 3787 +==================================================================+ 3788 | Tunnel0 | Proxy-CoA | LMAA1 | IPv6-in-IPv6 | 3789 +------------------------------------------------------------------+ 3790 | Tunnel1 | Proxy-CoA | LMAA2 | IPv6-in-IPv6 | 3791 +------------------------------------------------------------------+ 3793 Figure 25: Example - Tunnel Interface Table 3795 Authors' Addresses 3797 Sri Gundavelli 3798 Cisco 3799 170 West Tasman Drive 3800 San Jose, CA 95134 3801 USA 3803 Email: sgundave@cisco.com 3805 Kent Leung 3806 Cisco 3807 170 West Tasman Drive 3808 San Jose, CA 95134 3809 USA 3811 Email: kleung@cisco.com 3813 Vijay Devarapalli 3814 Wichorus 3815 3590 North First Street 3816 San Jose, CA 95134 3817 USA 3819 Email: vijay@wichorus.com 3820 Kuntal Chowdhury 3821 Starent Networks 3822 30 International Place 3823 Tewksbury, MA 3825 Email: kchowdhury@starentnetworks.com 3827 Basavaraj Patil 3828 Nokia Siemens Networks 3829 6000 Connection Drive 3830 Irving, TX 75039 3831 USA 3833 Email: basavaraj.patil@nsn.com 3835 Full Copyright Statement 3837 Copyright (C) The IETF Trust (2008). 3839 This document is subject to the rights, licenses and restrictions 3840 contained in BCP 78, and except as set forth therein, the authors 3841 retain all their rights. 3843 This document and the information contained herein are provided on an 3844 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 3845 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND 3846 THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS 3847 OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF 3848 THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 3849 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 3851 Intellectual Property 3853 The IETF takes no position regarding the validity or scope of any 3854 Intellectual Property Rights or other rights that might be claimed to 3855 pertain to the implementation or use of the technology described in 3856 this document or the extent to which any license under such rights 3857 might or might not be available; nor does it represent that it has 3858 made any independent effort to identify any such rights. Information 3859 on the procedures with respect to rights in RFC documents can be 3860 found in BCP 78 and BCP 79. 3862 Copies of IPR disclosures made to the IETF Secretariat and any 3863 assurances of licenses to be made available, or the result of an 3864 attempt made to obtain a general license or permission for the use of 3865 such proprietary rights by implementers or users of this 3866 specification can be obtained from the IETF on-line IPR repository at 3867 http://www.ietf.org/ipr. 3869 The IETF invites any interested party to bring to its attention any 3870 copyrights, patents or patent applications, or other proprietary 3871 rights that may cover technology that may be required to implement 3872 this standard. Please address the information to the IETF at 3873 ietf-ipr@ietf.org. 3875 Acknowledgment 3877 Funding for the RFC Editor function is provided by the IETF 3878 Administrative Support Activity (IASA).