Network Working Group J. Arkko Internet-Draft Ericsson Intended status: Informational M. Townsley Expires: January 6, 2012 Cisco July 5, 2011 Home Networking Architecture for IPv6 draft-arkko-townsley-homenet-arch-00 Abstract This memo focuses on the evolving networking technology within and among relatively small "residential home" networks. The goal of this memo is to define the architecture for IPv6-based home networking that supports the demands placed on it. This architecture shows how standard IPv6 mechanisms and addressing can be employed in home networking, and outlines the need for specific protocol extensions for certain additional functionality. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on January 6, 2012. Copyright Notice Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must Arkko & Townsley Expires January 6, 2012 [Page 1] Internet-Draft IPv6 Home Networking July 2011 include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Effects of IPv6 on Home Networking . . . . . . . . . . . . . . 3 3. Architecture . . . . . . . . . . . . . . . . . . . . . . . . . 5 3.1. Requirements . . . . . . . . . . . . . . . . . . . . . . . 8 3.2. Principles . . . . . . . . . . . . . . . . . . . . . . . . 9 3.3. Implementing the Architecture on IPv6 . . . . . . . . . . 10 4. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11 4.1. Normative References . . . . . . . . . . . . . . . . . . . 11 4.2. Informative References . . . . . . . . . . . . . . . . . . 11 Appendix A. Acknowledgments . . . . . . . . . . . . . . . . . . . 12 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 12 Arkko & Townsley Expires January 6, 2012 [Page 2] Internet-Draft IPv6 Home Networking July 2011 1. Introduction This memo focuses on the evolving networking technology within and among relatively small "residential home" networks and the associated challenges. For example, an obvious trend in home networking is the proliferation of networking technology in an increasingly broad range and number of devices. This evolution in scale and diversity sets some requirements on IETF protocols. Some of these requirements relate to the need for supporting multiple subnets for private and guest networks, the introduction of IPv6, and the introduction of specialized networks for home automation and sensors. While many advanced home networks have been built, most operate based on IPv4, employ solutions that we would like to avoid such as network address translation (NAT), or require an expert assistance to set up. The architectural constructs in this document are focused on the problems to be solved when introducing IPv6 with a eye towards a better result than what we have today with IPv4, as well as a better result than if the IETF had not given this specific guidance. This architecture document aims to provide the basis for how standard IPv6 mechanisms and addressing [RFC2460] [RFC4291] can be employed in home networking, while coexisting with existing IPv4 mechanisms that are widely deployed. 2. Effects of IPv6 on Home Networking Service providers are deploying IPv6, widely accessed content is becoming available on IPv6, and support for IPv6 is increasingly available in devices and software used in the home. While IPv6 resembles IPv4 in many ways, it changes address allocation principles and allows direct IP addressability and routing to devices in the home from the Internet. Following is an overview of some of the areas of that are both promising and problematic: Multiple segments While less complex L3-topologies involving as few subnets as possible are preferred in home networks for a variety of reasons including simpler management and service discovery, incorporation of dedicated segments remain necessary for some cases. For instance, a common feature in modern home routers in the ability to support both guest and private network segments. Also, link layer networking technology is poised to become more heterogeneous, as networks begin to employ both traditional Ethernet technology and link layers designed for low-powered sensor networks. Finally, similar needs for segmentation may Arkko & Townsley Expires January 6, 2012 [Page 3] Internet-Draft IPv6 Home Networking July 2011 occur in other cases, such as separating building control or corporate extensions from the Internet access network. Different segments may be associated with subnets that have different routing and security policies. Documents that provide some more specific background and depth on this topic include: [I-D.herbst-v6ops-cpeenhancements], r [I-D.baker-fun-multi-router], and [I-D.baker-fun-routing-class]. In addition to routing, rather than natting, between subnets, there are issues of when and how to extend mechanisms such as service discovery which currently rely on link-local addressing to limit scope. Security, Borders, and the elimination of NAT The End-to-end communication that is promised with IPv6 is both an incredible opportunity for innovation and easy of network operation, but it is also a concern as it it exposes nodes in the internal networks to receipt of otherwise unwanted traffic from the Internet. Firewalls that restrict incoming connections may be used to prevent exposure, however, this reduces the efficacy of end-to-end connectivity that IPv6 has the potential to restore. [RFC6092] provides recommendations for an IPv6 firewall that applies "limitations on end-to-end transparency where security considerations are deemed important to promote local and Internet security." The firewall operation is "Simple" in that there is an assumption that traffic which is to be blocked by default is defined in the RFC and not expected to be updated by the user or otherwise. Advanced Security for IPv6 CPE [I-D.vyncke-advanced-ipv6-security] takes the approach that in order to provide the greatest end-to-end transparency as well as security, security polices must be updated by a trusted party which can provide intrusion signatures an other "active" information on security threats. This is much like a virus- scanning tool which must receive updates in order to detect and/or neutralize the latest attacks as they arrive. As the name implies "Advanced" security requires significantly more resources and infrastructure (including a source for attack signatures) vs. "Simple" security. In addition to the security mechanisms themselves, it is important to know where to enable them. If there is some indication as to which router is connected to the "outside" of the home network, this is feasible. Otherwise, it can be difficult to know which security policies to apply where. Further, security policies may be different for various address ranges if ULA addressing is setup to only operate within the homenet itself and not be routed to the Arkko & Townsley Expires January 6, 2012 [Page 4] Internet-Draft IPv6 Home Networking July 2011 Internet at large. Naming, and manual configuration of IP addresses In IPv4, it is common practice to reach a router for configuration, DNS resolver functions, or otherwise via 192.168.1.1 or some other well-known RFC 1918 address. In IPv6, there is no such address space available, and generally IPv6 addresses are more cumbersome for humans to manually configure. As such, even for the simplest of functions, naming and the associated discovery of service is imperative for an easy to administer homenet. 3. Architecture An architecture outlines how to construct home networks involving multiple routers and subnets. In the following this memo presents a few typical home network topology models, followed by architectural principles that govern how the various nodes should work together. Finally, some guidelines are given for realizing the architecture with the IPv6 addressing architecture, prefix delegation, global and ULA addresses, source address selection rules and other existing components of the IPv6 architecture. The architecture also drives what protocols extensions are necessary, as will be discussed in Section 3.3. Figure 1 shows the simplest possible home network topology, involving just one router, a local area network, and a set of hosts. Setting up such networks is well understood today [RFC6204]. Arkko & Townsley Expires January 6, 2012 [Page 5] Internet-Draft IPv6 Home Networking July 2011 +-------+-------+ \ | Service | \ | Provider | | Service | Router | | Provider +-------+-------+ | network | / | Customer / | Internet connection / | +------+--------+ \ | IPv6 | \ | Customer Edge | \ | Router | / +------+--------+ / | | End-User Local Network | | network(s) ---+-----+-------+--- \ | | \ +----+-----+ +-----+----+ \ |IPv6 Host | |IPv6 Host | / | | | | / +----------+ +-----+----+ / Figure 1 Figure 2 shows another network that now introduces multiple local area networks. These may be needed for reasons relating to different link layer technology or for policy reasons. Note that a common arrangement is to have different link types supported on the same router, bridged together. For the purposes of this memo and IP layer operation this arrangement is considered equivalent to the topology in Figure 1. This topology is also relatively well understood today [RFC6204], though it certainly presents additional demands with regards suitable firewall policies and limits the operation of certain applications and discovery mechanisms. Arkko & Townsley Expires January 6, 2012 [Page 6] Internet-Draft IPv6 Home Networking July 2011 +-------+-------+ \ | Service | \ | Provider | | Service | Router | | Provider +------+--------+ | network | / | Customer / | Internet connection / | +------+--------+ \ | IPv6 | \ | Customer Edge | \ | Router | / +----+-------+--+ / Network A | | Network B | End-User ---+-------------+----+- --+--+-------------+--- | network(s) | | | | \ +----+-----+ +-----+----+ +----+-----+ +-----+----+ \ |IPv6 Host | |IPv6 Host | | IPv6 Host| |IPv6 Host | / | | | | | | | | / +----------+ +-----+----+ +----------+ +----------+ / Figure 2 ... Figure 3 shows a little bit more complex network with two routers and eight devices connected to one ISP. This network is similar to the one discussed in [I-D.ietf-v6ops-ipv6-cpe-router-bis]. The main complication in this topology compared to the ones described earlier is that there is no longer a single router that a priori understand the entire topology. The topology itself may also be complex, it may not be possible to assume a pure tree form, for instance. Arkko & Townsley Expires January 6, 2012 [Page 7] Internet-Draft IPv6 Home Networking July 2011 +-------+-------+ \ | Service | \ | Provider | | Service | Router | | Provider +-------+-------+ | network | / | Customer / | Internet connection | +------+--------+ \ | IPv6 | \ | Customer Edge | \ | Router | | +----+-+---+----+ | Network A | | | Network B/E | ----+-------------+----+ | +---+-------------+------+ | | | | | | | | | +----+-----+ +-----+----+ | +----+-----+ +-----+----+ | | |IPv6 Host | |IPv6 Host | | | IPv6 Host| |IPv6 Host | | | | | | | | | | | | | | +----------+ +-----+----+ | +----------+ +----------+ | | | | | | | | ---+------+------+-----+ | | | Network B/E | +------+--------+ | | End-User | IPv6 | | | networks | Interior +------+ | | Router | | +---+-------+-+-+ | Network C | | Network D | ----+-------------+---+- --+---+-------------+--- | | | | | | +----+-----+ +-----+----+ +----+-----+ +-----+----+ | |IPv6 Host | |IPv6 Host | | IPv6 Host| |IPv6 Host | | | | | | | | | | / +----------+ +-----+----+ +----------+ +----------+ / Figure 3 3.1. Requirements [RFC6204] defines "Basic" requirements for IPv6 Customer Edge Routers, while [I-D.ietf-v6ops-ipv6-cpe-router-bis] describes "advanced" features. In general, home network equipment needs to cope with different types of network topologies discussed above. Manual configuration is rarely, if at all, possible. The equipment needs to be prepared to handle at least Arkko & Townsley Expires January 6, 2012 [Page 8] Internet-Draft IPv6 Home Networking July 2011 o prefix configuration for routers o managing routing o name resolution o service discovery o network security Additional requirements may stem from support for multi-homing or multiple exit routers [I-D.baker-fun-multi-router]. 3.2. Principles There is little that the Internet standards community can do about the physical topologies or the need for some networks to be separated at the network layer for policy or link layer compatibility reasons. However, there is a lot of flexibility in using IP addressing and internetworking mechanisms. It would be desirable to provide some guidance on how this flexibility should be used to provide the best user experience and ensure that the network can evolve with new applications in the future. The authors believe that the following principles guide us in designing these networks in the correct manner: Largest Possible Subnets As part of the self-organization of the netowrk, the network should subdivide itself to the largest possible subnets that can be constructed with the constraints of link layer mechanisms, bridging, physical connectivity, and policy. For instance, separate subnetworks are necessary where two different links cannot be bridged, or when a policy requires the separation of a private and visitor parts of the network. Transparent End-to-End Communications An IPv6-based home network architecture should naturally offer a transparent end-to-end communications model. Each device should be addressable by a unique address. Security perimeters can of course restrict the end-to-end communications, but it is much easier to block certain nodes from communicating than it is to re- enable nodes to communicate if they have been hidden behind local addressing domains and address translation. Arkko & Townsley Expires January 6, 2012 [Page 9] Internet-Draft IPv6 Home Networking July 2011 IP Connectivity between All Nodes A logical consequence of the end-to-end communications model is that the network should attempt to provide IP-layer connectivity between all internal parts as well as between the internal parts and the Internet. This connectivity should be established at the link layer, if possible, and using routing at the IP layer otherwise. Self-Organization A home network architecture should be naturally self-organizing and self-configuring under different circumstances relating to connectivity status to the Internet, number of devices, and physical topology. Least Topology Assumptions There should be ideally no built-in assumptions about the topology in home networks, as users area capable of connecting their devices in ingenious ways. Discovery The most natural way to think about name and service discovery within a home is to enable it to work across the entire residence, disregarding technical borders such as subnets but respecting policy borders such as those between visitor and internal networks. Intelligent Policy As the Internet continues to evolve, no part of the architecture or security design should depend on hardcoding acceptable or unacceptable traffic patterns into the devices. Rather, these traffic patterns should be driven off up-to-date databases in the Internet. 3.3. Implementing the Architecture on IPv6 The necessary mechanisms are largely already part of the IPv6 protocol set and common implementations. The few known counter- examples are discussed in the following. For prefix configuration, existing protocols are likely sufficient, but may at worst may need some small enhancements, such as new options. For automatic routing, it is expected that existing routing protocols can be used as is, however, a new mechanism may be needed in order to turn a selected protocol on by default. Support for multiple exit routers and multi- Arkko & Townsley Expires January 6, 2012 [Page 10] Internet-Draft IPv6 Home Networking July 2011 homing would also require extensions. For name resolution and service discovery, extensions to existing multicast-based name resolution protocols are needed to enable them to work across subnets. The hardest problems in developing solutions for home networking IPv6 architectures include discovering the right borders where the domain "home" ends and the service provider domain begins, deciding whether some of necessary discovery mechanism extensions should affect only the network infrastructure or also hosts, and the ability to turn on routing, prefix delegation and other functions in a backwards compatible manner. 4. References 4.1. Normative References [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, December 1998. [RFC4291] Hinden, R. and S. Deering, "IP Version 6 Addressing Architecture", RFC 4291, February 2006. [RFC6092] Woodyatt, J., "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service", RFC 6092, January 2011. [RFC6204] Singh, H., Beebee, W., Donley, C., Stark, B., and O. Troan, "Basic Requirements for IPv6 Customer Edge Routers", RFC 6204, April 2011. 4.2. Informative References [I-D.baker-fun-multi-router] Baker, F., "Exploring the multi-router SOHO network", draft-baker-fun-multi-router-00 (work in progress), July 2011. [I-D.baker-fun-routing-class] Baker, F., "Routing a Traffic Class", draft-baker-fun-routing-class-00 (work in progress), July 2011. [I-D.herbst-v6ops-cpeenhancements] Herbst, T. and D. Sturek, "CPE Considerations in IPv6 Deployments", draft-herbst-v6ops-cpeenhancements-00 (work Arkko & Townsley Expires January 6, 2012 [Page 11] Internet-Draft IPv6 Home Networking July 2011 in progress), October 2010. [I-D.vyncke-advanced-ipv6-security] Vyncke, E. and M. Townsley, "Advanced Security for IPv6 CPE", draft-vyncke-advanced-ipv6-security-01 (work in progress), March 2010. [I-D.ietf-v6ops-ipv6-cpe-router-bis] Singh, H., Beebee, W., Donley, C., Stark, B., and O. Troan, "Advanced Requirements for IPv6 Customer Edge Routers", draft-ietf-v6ops-ipv6-cpe-router-bis-00 (work in progress), March 2011. Appendix A. Acknowledgments The authors would like to thank to Stuart Cheshire, James Woodyatt, Ole Troan, Lars Eggert, Ray Bellis, David Harrington, Wassim Haddad, Heather Kirksey, Dave Thaler, Fred Baker, and Ralph Droms for interesting discussions in this problem space. Authors' Addresses Jari Arkko Ericsson Jorvas 02420 Finland Email: jari.arkko@piuha.net Mark Townsley Cisco Paris 75006 France Email: townsley@cisco.com Arkko & Townsley Expires January 6, 2012 [Page 12]