YANG Modules for IPv4-in-IPv6 Address plus Port (A+P) SoftwiresDeutsche Telekom AGCTO-ATI, Landgrabenweg 151BonnNRW53227Germanyian.farrer@telekom.deOrangeRennes35000Francemohamed.boucadair@orange.comSoftwires Working GroupA+Paddress sharingport setPort rangeIPv4 service continuityNETCONFRESTCONFProgrammabilityDynamic provisioningautomationIPv6This document defines YANG modules for the configuration and
operation of IPv4-in-IPv6 softwire Border Relays and Customer Premises
Equipment for the Lightweight 4over6, Mapping of Address and Port with
Encapsulation (MAP-E), and Mapping of Address and Port using Translation
(MAP-T) softwire mechanisms.Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by
the Internet Engineering Steering Group (IESG). Further
information on Internet Standards is available in Section 2 of
RFC 7841.
Information about the current status of this document, any
errata, and how to provide feedback on it may be obtained at
.
Copyright Notice
Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
() in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with
respect to this document. Code Components extracted from this
document must include Simplified BSD License text as described in
Section 4.e of the Trust Legal Provisions and are provided without
warranty as described in the Simplified BSD License.
Table of Contents
. Introduction
. Terminology
. Overview of the Modules
. Overall Structure
. Configuration for Additional Components
. Softwire CE YANG Tree Diagram
. CE Tree Diagram
. Softwire CE Tree Diagram Description
. Softwire BR YANG Tree Diagram
. BR Tree Diagram
. Softwire BR Tree Diagram Description
. Softwire CE YANG Module
. BR Softwire YANG Module
. Common Softwire Element Groups YANG Module
. Security Considerations
. IANA Considerations
. References
. Normative References
. Informative References
. Configuration Examples
. Configuration Example for a lw4o6 BR Binding-Table
. Configuration Example for a MAP-E BR
. lw4o6 CE Configuration Example
Acknowledgements
Contributors
Authors' Addresses
IntroductionThe IETF Softwire Working Group has developed several IPv4-in-IPv6
softwire mechanisms to address various deployment contexts and
constraints. As a companion to the architectural specification
documents, this document focuses on the provisioning of Address plus
Port (A+P) softwire functional elements: Border Routers (BRs) and
Customer Edge (CE) (called "Customer Premises Equipment (CPE)"
in ). The softwire mechanisms
covered in this document are Lightweight 4over6 (lw4o6) , Mapping of Address and Port with Encapsulation
(MAP-E) , and Mapping of Address and Port
using Translation (MAP-T) .This document focuses on A+P mechanisms ; the reader can refer to for a YANG module for Dual-Stack Lite (DS-Lite) .This document defines YANG modules
that can be used to configure and manage A+P softwire elements using the
NETCONF or RESTCONF protocols for:
Configuration
Operational State
Notifications
TerminologyThe reader should be familiar with the concepts and terms defined in
, , , and the YANG data modeling language defined
in .The YANG modules in this document adopt the Network Management
Datastore Architecture (NMDA) . The
meanings of the symbols used in tree diagrams are defined in .The document uses the abbreviation 'BR' as a general term for
softwire tunnel concentrators, including both MAP Border Routers and Lightweight 4over6 lwAFTRs .For brevity, "algorithm" is used to refer to the "mapping algorithm"
defined in .A network element may support one or multiple instances of a softwire
mechanism; each of these instances (i.e., binding instances, MAP-E
instances, or MAP-T instances) may have its own configuration and
parameters. The term 'algo-instance' is used to denote both MAP-E and
MAP-T instances.Overview of the ModulesOverall StructureThe document defines the following two YANG modules for the
configuration and monitoring of softwire functional elements:
ietf-softwire-ce
Provides configuration and
monitoring for softwire CE element. This module is defined as
augments to the interface YANG module .
ietf-softwire-br
Provides configuration and
monitoring for softwire BR element.
In addition, the following module is defined:
ietf-softwire-common
Contains groups of common
functions that are imported into the CE and BR modules.
This approach has been taken so that the various modules can be
easily extended to support additional softwire mechanisms, if
required.Within the BR and CE modules, the YANG "feature" statement is used
to distinguish which of the different softwire mechanism(s) is
relevant for a specific element's configuration. For each module, a
choice statement 'ce-type' is included for either 'binding' or
'algorithm'. 'Binding' is used for configuring Lightweight 4over6,
whereas 'algorithm' is used for configuring MAP-T or MAP-E.In the 'algo-instances' container, a choice statement 'data-plane'
is included to specify MAP-E (encapsulation) or MAP-T (translation).
shows how these
choices are used to indicate the desired softwire mechanism:
Softwire Mechanism Choice Statement Enumeration
S46 Mechanism
ce-type?
data-plane?
Lightweight 4over6
binding
n/a
MAP-E
algorithm
encapsulation
MAP-T
algorithm
translation
NETCONF notifications are also included.Configuration for Additional ComponentsThe softwire modules only aim to provide configuration relevant for
softwires. In order to fully provision a CE element, the following may
also be necessary:
IPv6 forwarding and routing configuration, to enable the CE to
obtain one or more IPv6 prefixes for softwire usage. A YANG module
for routing management is described in .
IPv4 routing configuration, to add one or more IPv4 destination
prefix(es) reachable via the configured softwire. A YANG module
for routing management is described in .
Stateful NAT44/NAPT management, to optionally specify a port
set (Port Set Identifier (PSID)) along with its length. A YANG
module for NAT management is described in .
Stateless NAT46 management, which is required by
softwire-translation-based mechanisms (i.e., the assignment of a
Network-Specific Prefix to use for IPv4/IPv6 translation). A YANG module for NAT
management is described in .
As YANG modules for the above functions are already defined in
other documents, their functionality is not duplicated here and they
should be referred to, as needed. provides XML examples of how these
modules can be used together.The CE must already have minimal IPv6 configuration in place so it
is reachable by the NETCONF client to obtain softwire configuration.
If additional IPv6-specific configuration is necessary, the YANG
modules defined in and may be used.Softwire CE YANG Tree DiagramCE Tree DiagramThe CE module provides configuration and monitoring for all of the
softwire mechanisms covered in this document (i.e., Lightweight
4over6, MAP-E, and MAP-T).This module augments "ietf-interfaces", defined in with an entry for the softwire. This entry
can be referenced to configure IPv4 forwarding features for the
element. This entry is added only if tunnel type () is set to 'aplusp'. shows the tree structure of
the softwire CE YANG module:Softwire CE Tree Diagram DescriptionAdditional information related to the operation of a CE element is
provided below:
softwire-payload-mtu:
optionally used to set the IPv4 Maximum Transmission Unit (MTU) for
the softwire. Needed if the softwire implementation is unable to
correctly calculate the correct IPv4 MTU
size automatically.
softwire-path-mru:
optionally used to set the maximum IPv6
softwire packet size that can be received, including the
encapsulation/translation overhead. Needed if the softwire
implementation is unable to correctly calculate the correct IPv4
payload Maximum Receive Unit (MRU) size automatically (see ).
ce-type:
provides a choice statement allowing the binding or
algorithmic softwire mechanisms to be selected.
Further details relevant to binding softwire elements are as follows:
binding-ipv6info:
used to set the IPv6 binding prefix type to
identify which IPv6 address to use as the tunnel source. It can be
'ipv6-prefix' or 'ipv6-address'.
br-ipv6-addr:
sets the IPv6 address of the remote BR.
Additional details relevant to some of the important algorithmic
elements are provided below:
algo-versioning:
optionally used to associate a version number
and/or timestamp to the algorithm. This can be used for
logging/data retention purposes .
The version number is selected to uniquely identify the algorithm
configuration and a new value written whenever a change is made to
the algorithm or a new algo-instance is created.
forwarding:
specifies whether the rule can be used as a Forwarding
Mapping Rule (FMR). If not set, this rule is a Basic Mapping Rule
(BMR) only and must not be used for forwarding. Refer to .
ea-len:
used to set the length of the Embedded-Address (EA),
which is defined in the mapping rule for a MAP domain.
data-plane:
provides a choice statement for either
encapsulation (MAP-E) or translation (MAP-T).
br-ipv6-addr:
defines the IPv6 address of the BR. This
information is valid for MAP-E.
dmr-ipv6-prefix:
defines the Default Mapping Rule (DMR) IPv6
prefix of the BR. This information is valid for MAP-T.
Additional information on the notification node is listed
below:
ce-binding-ipv6-addr-change:
if the CE's binding IPv6 address
changes for any reason, the NETCONF client will be notified.
Softwire BR YANG Tree DiagramBR Tree DiagramThe BR YANG module provides configuration and monitoring for all of
the softwire mechanisms covered in this document (i.e., Lightweight
4over6, MAP-E, and MAP-T). provides the tree structure of
this module:Softwire BR Tree Diagram DescriptionThe descriptions for leaves that are common with the CE module are
provided in . Descriptions
for additional elements are provided below:
binding-table-versioning:
optionally used to associate a
version number and/or timestamp to the binding table. This can be
used for logging or data retention purposes . The version number is selected to
uniquely identify the binding table configuration and a new
timestamp value written whenever a change is made to the contents
of the binding table or a new binding table list is created.
binding-entry:
used to define the binding relationship between
3-tuples {lwB4's IPv6 address/prefix, the allocated IPv4 address,
restricted port-set}. For detailed information, please refer to
.
softwire-num-max:
used to set the maximum number of softwire
binding rules that can be created on the lw4o6 element
simultaneously. This parameter must not be set to zero because this
is equivalent to disabling the BR instance.
active-softwire-num:
holds the number of softwires currently
provisioned on the BR element.
Additional information on some of the important notification nodes
is listed below:
invalid-entry, added-entry, modified-entry:
used to notify the
NETCONF client that a specific binding entry or MAP rule has
expired, been invalidated, added, or modified.
Softwire CE YANG ModuleThis module imports the modules defined in , , and . It also imports the
'ietf-softwire-common' and 'iana-tunnel-type' modules .
module ietf-softwire-ce {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-softwire-ce";
prefix softwire-ce;
import ietf-inet-types {
prefix inet;
reference
"RFC 6991: Common YANG Data Types, Section 4";
}
import ietf-interfaces {
prefix if;
reference
"RFC 8343: A YANG Data Model for Interface Management";
}
import ietf-softwire-common {
prefix softwire-common;
reference
"RFC 8676: YANG Modules for IPv4-in-IPv6 Address plus Port
Softwires";
}
import iana-tunnel-type {
prefix iana-tunnel-type;
reference
"RFC 8675: A YANG Data Model for Tunnel Interface Types";
}
organization
"IETF Softwire Working Group";
contact
"WG Web: <https://datatracker.ietf.org/wg/softwire/>
WG List: <mailto:softwire@ietf.org>
Author: Qi Sun
<mailto:sunqi.ietf@gmail.com>
Author: Linhui Sun
<mailto:lh.sunlinh@gmail.com>
Author: Yong Cui
<mailto:yong@csnet1.cs.tsinghua.edu.cn>
Editor: Ian Farrer
<mailto:ian.farrer@telekom.de>
Author: Sladjana Zoric
<mailto:sladjana.zoric@telekom.de>
Editor: Mohamed Boucadair
<mailto:mohamed.boucadair@orange.com>
Author: Rajiv Asati
<mailto:rajiva@cisco.com>";
description
"This document defines a YANG module for the configuration and
management of A+P Softwire Customer Premises Equipment (CEs).
It covers Lightweight 4over6, MAP-E, and MAP-T mechanisms.
Copyright (c) 2019 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC 8676; see
the RFC itself for full legal notices.";
revision 2019-11-16 {
description
"Initial revision.";
reference
"RFC 8676: YANG Modules for IPv4-in-IPv6 Address plus Port
(A+P) Softwires";
}
/*
* Features
*/
feature binding-mode {
description
"Binding is used for configuring the Lightweight 4over6
mechanism.
Binding-based softwire mechanisms are IPv4-over-IPv6 tunneling
transition mechanisms specifically intended for complete
independence between the IPv6 subnet prefix (and IPv6 address)
and IPv4 address, with or without IPv4 address sharing.
This is accomplished by maintaining state for each softwire
(per-subscriber state) in the central Border Relay (BR) and
using a hub-and-spoke forwarding architecture. In order to
delegate the NAPT function and achieve IPv4 address sharing,
port-restricted IPv4 addresses needs to be allocated to CEs.
This feature indicates that the network element can function
as one or more binding-based softwire instances.";
reference
"RFC 7596: Lightweight 4over6: An Extension to the Dual-Stack
Lite Architecture
RFC 7597: Mapping of Address and Port with Encapsulation
(MAP-E)
RFC 7599: Mapping of Address and Port using Translation
(MAP-T)";
}
feature map-e {
description
"MAP-E is an IPv6 transition mechanism for transporting IPv4
packets across an IPv6 network using IP encapsulation. MAP-E
allows for a reduction of the amount of centralized state
using rules to express IPv4/IPv6 address mappings. This
introduces an algorithmic relationship between the IPv6
subnet and IPv4 address.
This feature indicates that the network element can function
as one or more MAP-E softwire instances.";
reference
"RFC 7597: Mapping of Address and Port with
Encapsulation (MAP-E)";
}
feature map-t {
description
"MAP-T is an IPv6 transition mechanism for transporting IPv4
packets across an IPv6 network using IP translation. It
leverages a double stateless NAT64-based solution as well as
the stateless algorithmic address and transport layer port
mapping algorithm defined for MAP-E.
This feature indicates that the network element can function
as one or more MAP-T softwire instances.";
reference
"RFC 7599: Mapping of Address and Port using Translation
(MAP-T)";
}
// Binding Entry
grouping binding-entry {
description
"The binding BR (Border Relay) maintains an address
binding table that contains the binding between the CE's
IPv6 address, the allocated IPv4 address, and the
restricted port-set.";
leaf binding-ipv6info {
type union {
type inet:ipv6-address;
type inet:ipv6-prefix;
}
description
"The IPv6 information for a binding entry.
When the IPv6 prefix type is used,
the IPv6 source address of the CE is constructed
according to the description in RFC 7596.
If the IPv6 address type is used, the CE can use
any valid /128 address from a prefix assigned to
the CE.";
reference
"RFC 7596: Lightweight 4over6: An Extension
to the Dual-Stack Lite Architecture, Section 5.1";
}
leaf br-ipv6-addr {
type inet:ipv6-address;
mandatory true;
description
"The IPv6 address of the binding BR.";
}
}
// configuration and stateful parameters for softwire CE interface
augment "/if:interfaces/if:interface" {
when "derived-from(if:type, 'iana-tunnel-type:aplusp')";
description
"Softwire CE interface configuration";
leaf softwire-payload-mtu {
type uint16;
units "bytes";
description
"The payload IPv4 MTU for the softwire tunnel.";
}
leaf softwire-path-mru {
type uint16;
units "bytes";
description
"The path MRU for the softwire (payload + encapsulation
overhead).";
reference
"RFC 4213: Basic Transition Mechanisms for IPv6 Hosts and
Routers";
}
choice ce-type {
description
"Sets the softwire CE mechanism";
case binding {
if-feature "binding-mode";
description
"CE binding configuration";
uses binding-entry;
}
case algo {
if-feature "map-e or map-t";
description
"CE algorithm configuration";
container algo-instances {
description
"Collection of MAP-E/MAP-T parameters";
list algo-instance {
key "name";
description
"MAP forwarding rule instance for
MAP-E/MAP-T";
leaf name {
type string;
mandatory true;
description
"The name is used to uniquely identify an algorithm
instance.
This name can be automatically assigned
or explicitly configured.";
}
uses softwire-common:algorithm-instance;
}
}
}
}
}
augment "/if:interfaces/if:interface/if:statistics" {
when "derived-from(../if:type, 'iana-tunnel-type:aplusp')";
description
"Softwire CE interface statistics.";
uses softwire-common:traffic-stat;
}
/*
* Notifications
*/
notification softwire-ce-event {
if-feature "binding-mode";
description
"CE notification";
leaf ce-binding-ipv6-addr-change {
type inet:ipv6-address;
mandatory true;
description
"This notification is generated whenever the CE's binding
IPv6 address changes for any reason.";
}
}
}
BR Softwire YANG ModuleThis module imports typedefs from . It
also imports the 'ietf-softwire-common' module.
module ietf-softwire-br {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-softwire-br";
prefix softwire-br;
import ietf-inet-types {
prefix inet;
reference
"RFC 6991: Common YANG Data Types, Section 4";
}
import ietf-yang-types {
prefix yang;
reference
"RFC 6991: Common YANG Data Types, Section 3";
}
import ietf-softwire-common {
prefix softwire-common;
reference
"RFC 8676: YANG Modules for IPv4-in-IPv6 Address plus Port
(A+P) Softwires";
}
organization
"IETF Softwire Working Group";
contact
"WG Web: <https://datatracker.ietf.org/wg/softwire/>
WG List: <mailto:softwire@ietf.org>
Author: Qi Sun
<mailto:sunqi.ietf@gmail.com>
Author: Linhui Sun
<mailto:lh.sunlinh@gmail.com>
Author: Yong Cui
<mailto:yong@csnet1.cs.tsinghua.edu.cn>
Editor: Ian Farrer
<mailto:ian.farrer@telekom.de>
Author: Sladjana Zoric
<mailto:sladjana.zoric@telekom.de>
Editor: Mohamed Boucadair
<mailto:mohamed.boucadair@orange.com>
Author: Rajiv Asati
<mailto:rajiva@cisco.com>";
description
"This document defines a YANG module for the configuration and
management of A+P Softwire Border Routers. It covers
Lightweight 4over6, MAP-E, and MAP-T mechanisms.
Copyright (c) 2019 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC 8676; see
the RFC itself for full legal notices.";
revision 2019-11-16 {
description
"Initial revision.";
reference
"RFC 8676: YANG Modules for IPv4-in-IPv6 Address plus Port
(A+P) Softwires";
}
/*
* Groupings
*/
grouping port-set {
description
"Describes a set of Layer 4 port numbers.
This may be a simple port range, or use the Port Set
Identifier (PSID) algorithm to represent a range of transport
layer ports that will be used by a NAPT.";
leaf psid-offset {
type uint8 {
range "0..16";
}
description
"The number of offset bits. In Lightweight 4over6,
the default value is 0 for assigning one contiguous
port range. In MAP-E/T, the default value is 6,
which means the system ports (0-1023) are excluded by
default and the assigned port ranges are distributed across
the entire port space, depending on either psid-len or the
number of contiguous ports.";
}
leaf psid-len {
type uint8 {
range "0..15";
}
mandatory true;
description
"The length of PSID, representing the sharing
ratio for an IPv4 address. This, along with ea-len, can
be used to calculate the number of contiguous ports per
port range";
}
leaf psid {
type uint16;
mandatory true;
description
"Port Set Identifier (PSID) value, which
identifies a set of ports algorithmically.";
}
}
grouping binding-entry {
description
"The binding BR maintains an address binding table that
contains the binding between the CE's IPv6 address,
the allocated IPv4 address and restricted port-set.";
leaf binding-ipv6info {
type union {
type inet:ipv6-address;
type inet:ipv6-prefix;
}
description
"The IPv6 information for a CE binding entry.
When the IPv6 prefix type is used,
the IPv6 source address of the CE is constructed
according to the description in RFC 7596;
if the IPv6 address type is used, the CE can use
any valid /128 address from a prefix assigned to
the CE.";
reference
"RFC 7596: Lightweight 4over6: An Extension to the Dual-Stack
Lite Architecture";
}
leaf binding-ipv4-addr {
type inet:ipv4-address;
description
"The IPv4 address assigned to the binding CE,
which is used as the IPv4 external address
for binding CE local NAPT44.";
}
container port-set {
description
"For Lightweight 4over6, the default value
for offset should be 0, to configure one contiguous
port range.";
uses port-set {
refine "psid-offset" {
default "0";
}
}
}
leaf br-ipv6-addr {
type inet:ipv6-address;
description
"The IPv6 address for binding BR.";
}
}
/*
* Features
*/
feature binding-mode {
description
"Binding is used for configuring the Lightweight 4over6
mechanism.
Binding-based softwire mechanisms are IPv4-over-IPv6 tunneling
transition mechanisms specifically intended for complete
independence between the IPv6 subnet prefix (and IPv6 address)
and IPv4 address, with or without IPv4 address sharing.
This is accomplished by maintaining state for each softwire
(per-subscriber state) in the central Border Relay (BR) and
using a hub-and-spoke forwarding architecture. In order to
delegate the NAPT function and achieve IPv4 address sharing,
port-restricted IPv4 addresses needs to be allocated to CEs.
This feature indicates that the network element can function
as one or more binding-based softwire instances.";
reference
"RFC 7596: Lightweight 4over6: An Extension to the Dual-Stack
Lite Architecture
RFC 7597: Mapping of Address and Port with Encapsulation
(MAP-E)
RFC 7599: Mapping of Address and Port using Translation
(MAP-T)";
}
feature map-e {
description
"MAP-E is an IPv6 transition mechanism for transporting IPv4
packets across an IPv6 network using IP encapsulation. MAP-E
allows for a reduction of the amount of centralized state
using rules to express IPv4/IPv6 address mappings. This
introduces an algorithmic relationship between the IPv6 subnet
and IPv4 address.
This feature indicates that the network element can function
as one or more MAP-E softwire instances.";
reference
"RFC 7597: Mapping of Address and Port with Encapsulation
(MAP-E)";
}
feature map-t {
description
"MAP-T is an IPv6 transition mechanism for transporting IPv4
packets across an IPv6 network using IP translation. It
leverages a double stateless NAT64-based solution as well
as the stateless algorithmic address and transport layer
port mapping algorithm defined for MAP-E.
This feature indicates that the network element can function
as one or more MAP-T softwire instances.";
reference
"RFC 7599: Mapping of Address and Port using Translation
(MAP-T)";
}
container br-instances {
description
"BR instances enabled in a network element.";
choice br-type {
description
"Select binding or algorithmic BR functionality.";
case binding {
if-feature "binding-mode";
container binding {
description
"binding mechanism (binding table) configuration.";
list bind-instance {
key "name";
description
"A set of binding instances to be configured.";
leaf name {
type string;
mandatory true;
description
"The name for the binding BR. It is used to uniquely
distinguish a binding instance by its name.";
}
container binding-table-versioning {
description
"binding table's version";
leaf version {
type uint64;
description
"Version number for this binding table.";
}
leaf date {
type yang:date-and-time;
description
"Timestamp when the binding table was activated.
A binding instance may be provided with binding
entries that may change in time (e.g., increase
the size of the port set). When a party who is
the victim of abuse presents an external IP
address/port, the version of the binding table
is important because, depending on the version,
a distinct customer may be identified.
The timestamp is used as a key to find the
appropriate binding table that was put into effect
when an abuse occurred.";
reference
"RFC 7422: Deterministic Address Mapping to Reduce
Logging in Carrier-Grade NAT Deployments";
}
}
leaf softwire-num-max {
type uint32 {
range "1..max";
}
mandatory true;
description
"The maximum number of softwires that can be created
on the binding BR.";
}
leaf softwire-payload-mtu {
type uint16;
units "bytes";
mandatory true;
description
"The payload IPv4 MTU for binding softwire.";
}
leaf softwire-path-mru {
type uint16;
units "bytes";
mandatory true;
description
"The path MRU for binding softwire";
reference
"RFC 4213: Basic Transition Mechanisms for IPv6 Hosts
and Routers";
}
leaf enable-hairpinning {
type boolean;
default "true";
description
"Enables/disables support for locally forwarding
(hairpinning) traffic between two CEs";
reference
"RFC 7596: Lightweight 4over6: An Extension to
the Dual-Stack Lite Architecture, Section 6.2";
}
container binding-table {
description
"binding table";
list binding-entry {
key "binding-ipv6info";
description
"binding entry";
uses binding-entry;
}
}
container icmp-policy {
description
"The binding BR can be configured to process or drop
incoming ICMP messages and to generate outgoing ICMP
error messages.";
container icmpv4-errors {
description
"ICMPv4 error processing configuration";
leaf allow-incoming-icmpv4 {
type boolean;
default "true";
description
"Enables the processing of incoming ICMPv4
packets.";
reference
"RFC 7596: Lightweight 4over6: An Extension to
the Dual-Stack Lite Architecture";
}
leaf icmpv4-rate {
type uint32;
description
"Rate limit threshold in messages per second
for processing incoming ICMPv4 errors messages";
}
leaf generate-icmpv4-errors {
type boolean;
default "true";
description
"Enables the generation of outgoing ICMPv4 error
messages on receipt of an inbound IPv4 packet
with no matching binding table entry.";
reference
"RFC 7596: Lightweight 4over6:
An Extension to the Dual-Stack Lite
Architecture, Section 5.2";
}
}
container icmpv6-errors {
description
"ICMPv6 error processing configuration";
leaf generate-icmpv6-errors {
type boolean;
default "true";
description
"Enables the generation of ICMPv6 error messages
if no matching binding table entry is found for
a received packet.";
reference
"RFC 7596: Lightweight 4over6:
An Extension to the Dual-Stack Lite
Architecture, Section 6.2";
}
leaf icmpv6-rate {
type uint32;
description
"Rate limit threshold in messages per second
for sending ICMPv6 errors messages";
reference
"RFC 7596: Lightweight 4over6: An Extension
to the Dual-Stack Lite Architecture, Section 9";
}
}
}
container traffic-stat {
config false;
description
"Traffic statistics information for the BR.";
leaf discontinuity-time {
type yang:date-and-time;
mandatory true;
description
"The time of the most recent occasion on which the
BR instance suffered a discontinuity. This must
be initialized when the BR instance is configured
or rebooted.";
}
uses softwire-common:traffic-stat;
leaf dropped-icmpv4-packets {
type yang:zero-based-counter64;
description
"ICMPv4 packets that are dropped as a result
of the ICMP policy. Typically, this can be any
incoming ICMPv4 packets if ICMPv4 processing is
disabled or incoming ICMPv4 packets that exceed
the ICMPv4 rate-limit threshold.
Discontinuities in the value of this counter can
occur at re-initialization of the management
system and at other times as indicated by
the value of 'discontinuity-time'.";
}
leaf dropped-icmpv4-bytes {
type yang:zero-based-counter64;
description
"ICMPv4 messages, in bytes, that are dropped as
a result of the ICMP policy. Typically, it
can be any incoming ICMPv4 packets if ICMPv4
processing is disabled or incoming ICMPv4
packets that exceed the ICMPv4 rate-limit
threshold.
Discontinuities in the value of this counter can
occur at re-initialization of the management
system and at other times as indicated by
the value of 'discontinuity-time'.";
}
leaf hairpin-ipv4-packets {
type yang:zero-based-counter64;
description
"IPv4 packets locally routed between two CEs
(hairpinned).
Discontinuities in the value of this counter can
occur at re-initialization of the management
system and at other times as indicated by
the value of 'discontinuity-time'.";
}
leaf hairpin-ipv4-bytes {
type yang:zero-based-counter64;
description
"IPv4 bytes locally routed between two CEs
(hairpinned).
Discontinuities in the value of this counter can
occur at re-initialization of the management
system and at other times as indicated by
the value of 'discontinuity-time'.";
}
leaf active-softwire-num {
type uint32;
config false;
description
"The number of currently active softwires on the
binding instance.
Discontinuities in the value of this counter can
occur at re-initialization of the management
system and at other times as indicated by
the value of 'discontinuity-time'.";
}
}
}
}
}
case algo {
if-feature "map-e or map-t";
container algorithm {
description
"A set of parameters used for MAP-E/MAP-T";
list algo-instance {
key "name";
description
"Instances of algorithm";
leaf name {
type string;
mandatory true;
description
"The name is used to uniquely identify an algorithm
instance.
This name can be automatically assigned
or explicitly configured.";
}
uses softwire-common:algorithm-instance;
container port-set {
description
"Indicates a set of ports.";
uses port-set;
}
container traffic-stat {
config false;
description
"Traffic statistics information for the BR.";
leaf discontinuity-time {
type yang:date-and-time;
mandatory true;
description
"The time of the most recent occasion on which the
BR instance suffered a discontinuity. This must
be reset to the current date-and-time when the BR
instance is configured or rebooted.";
}
uses softwire-common:traffic-stat;
}
}
}
}
}
}
/*
* Notifications
*/
notification softwire-binding-instance-event {
if-feature "binding-mode";
description
"Notifications for the binding instance when an entry is
added, modified, or is not valid anymore.";
leaf bind-name {
type leafref {
path "/br-instances/binding/bind-instance/name";
}
description
"The name of the binding-instance that
generated the notification.";
}
leaf-list invalid-entry {
type leafref {
path "/br-instances/binding/"
+ "bind-instance[name=current()/../bind-name]/"
+ "binding-table/binding-entry/binding-ipv6info";
}
description
"Notify the client that a specific binding entry has
expired or is invalid. The binding-ipv6info identifies
an entry.";
}
leaf-list added-entry {
type inet:ipv6-address;
description
"Notify the client that a binding entry has been added.
The IPv6 address of that entry is the index. The client
gets other information from the binding BR about the entry
indexed by that ipv6 address.";
}
leaf-list modified-entry {
type leafref {
path "/br-instances/binding/"
+ "bind-instance[name=current()/../bind-name]/"
+ "binding-table/binding-entry/binding-ipv6info";
}
description
"The binding table entry that has been modified.";
}
}
notification softwire-algorithm-instance-event {
if-feature "map-e or map-t";
description
"Notifications for an algorithm instance when an entry is
added, modified, or is not valid anymore.";
leaf algo-name {
type leafref {
path "/br-instances/algorithm/algo-instance/name";
}
mandatory true;
description
"Algorithmic instance event.";
}
leaf-list invalid-entry {
type leafref {
path "/br-instances/algorithm/algo-instance/name";
}
description
"Invalid entry.";
}
leaf-list added-entry {
type leafref {
path "/br-instances/algorithm/algo-instance/name";
}
description
"Added entry.";
}
leaf-list modified-entry {
type leafref {
path "/br-instances/algorithm/algo-instance/name";
}
description
"Modified entry.";
}
}
}
Common Softwire Element Groups YANG ModuleThis module imports typedefs from .The following YANG module contains definitions that are used by both
the softwire CE and softwire BR YANG modules.
module ietf-softwire-common {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-softwire-common";
prefix softwire-common;
import ietf-inet-types {
prefix inet;
reference
"RFC 6991: Common YANG Data Types, Section 4";
}
import ietf-yang-types {
prefix yang;
reference
"RFC 6991: Common YANG Data Types, Section 3";
}
organization
"IETF Softwire Working Group";
contact
"WG Web: <https://datatracker.ietf.org/wg/softwire/>
WG List: <mailto:softwire@ietf.org>
Author: Qi Sun
<mailto:sunqi.ietf@gmail.com>
Author: Linhui Sun
<mailto:lh.sunlinh@gmail.com>
Author: Yong Cui
<mailto:yong@csnet1.cs.tsinghua.edu.cn>
Editor: Ian Farrer
<mailto:ian.farrer@telekom.de>
Author: Sladjana Zoric
<mailto:sladjana.zoric@telekom.de>
Editor: Mohamed Boucadair
<mailto:mohamed.boucadair@orange.com>
Author: Rajiv Asati
<mailto:rajiva@cisco.com>";
description
"This document defines a YANG module defining types
common to all A+P modules.
Copyright (c) 2019 IETF Trust and the persons identified as
authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC 8676; see
the RFC itself for full legal notices.";
revision 2019-11-16 {
description
"Initial revision.";
reference
"RFC 8676: YANG Modules for IPv4-in-IPv6 Address plus Port
(A+P) Softwires";
}
feature map-e {
description
"MAP-E is an IPv6 transition mechanism for transporting IPv4
packets across an IPv6 network using IP encapsulation. MAP-E
allows for a reduction of the amount of centralized state
using rules to express IPv4/IPv6 address mappings. This
introduces an algorithmic relationship between the IPv6
subnet and IPv4 address.
This feature indicates that the network element can function
as one or more MAP-E softwire instances.";
reference
"RFC 7597: Mapping of Address and Port with Encapsulation
(MAP-E)";
}
feature map-t {
description
"MAP-T is an IPv6 transition mechanism for transporting IPv4
packets across an IPv6 network using IP translation. It
leverages a double stateless NAT64-based solution as well as
the stateless algorithmic address and transport layer
port mapping algorithm defined for MAP-E.
This feature indicates that the network element can function
as one or more MAP-T softwire instances.";
reference
"RFC 7599: Mapping of Address and Port using Translation
(MAP-T)";
}
/*
* Groupings
*/
grouping algorithm-instance {
description
"A collection of parameters that is used for MAP-E/MAP-T.";
leaf enable {
type boolean;
description
"Enable/disable an individual MAP-E or MAP-T rule.";
}
container algo-versioning {
description
"Version number for this algorithm instance";
leaf version {
type uint64;
description
"A version number for the mapping algorithm
rules provided to the algorithm instance";
}
leaf date {
type yang:date-and-time;
description
"Timestamp when the algorithm instance was activated.
An algorithm instance may be provided with mapping
rules that may change in time (for example, increase
the size of the port set). When a party who is the victim
of abuse presents an external IP address/port, the version
of the algorithm is important because depending on
the version, a distinct customer may be identified.
The timestamp is used as a key to find the appropriate
algorithm that was put into effect when an abuse
occurred.";
reference
"RFC 7422: Deterministic Address Mapping to Reduce
Logging in Carrier-Grade NAT Deployments";
}
}
choice data-plane {
description
"Selects MAP-E (encapsulation) or MAP-T
(translation)";
case encapsulation {
if-feature "map-e";
description
"encapsulation for MAP-E";
leaf br-ipv6-addr {
type inet:ipv6-address;
mandatory true;
description
"The IPv6 address of the MAP-E BR.";
}
}
case translation {
if-feature "map-t";
description
"translation for MAP-T";
leaf dmr-ipv6-prefix {
type inet:ipv6-prefix;
description
"The IPv6 prefix of the MAP-T BR.";
}
}
}
leaf ea-len {
type uint8;
mandatory true;
description
"Embedded Address (EA) bits are the IPv4 EA-bits in the IPv6
address identifying an IPv4 prefix/address (or part thereof)
or a shared IPv4 address (or part thereof) and a port-set
identifier. The length of the EA-bits is defined as part of
a MAP rule for a MAP domain.";
}
leaf rule-ipv6-prefix {
type inet:ipv6-prefix;
mandatory true;
description
"The Rule IPv6 prefix defined in the mapping rule.";
}
leaf rule-ipv4-prefix {
type inet:ipv4-prefix;
mandatory true;
description
"The Rule IPv4 prefix defined in the mapping rule.";
}
leaf forwarding {
type boolean;
mandatory true;
description
"This parameter specifies whether the rule may be used for
forwarding; if set, this rule is used as a Forwarding
Mapping Rule (FMR); if not set, this rule is a Basic
Mapping Rule (BMR) only and must not be used for
forwarding.";
}
}
grouping traffic-stat {
description
"Traffic statistics";
leaf sent-ipv4-packets {
type yang:zero-based-counter64;
description
"Number of decapsulated and forwarded IPv4 packets.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf sent-ipv4-bytes {
type yang:zero-based-counter64;
description
"Decapsulated/translated IPv4 traffic sent, in bytes.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf sent-ipv6-packets {
type yang:zero-based-counter64;
description
"Number of encapsulated IPv6 packets sent.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf sent-ipv6-bytes {
type yang:zero-based-counter64;
description
"Encapsulated IPv6 traffic sent, in bytes.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf rcvd-ipv4-packets {
type yang:zero-based-counter64;
description
"Number of IPv4 packets received.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf rcvd-ipv4-bytes {
type yang:zero-based-counter64;
description
"IPv4 traffic received, in bytes.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf rcvd-ipv6-packets {
type yang:zero-based-counter64;
description
"Number of IPv4-in-IPv6 packets received.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf rcvd-ipv6-bytes {
type yang:zero-based-counter64;
description
"IPv4-in-IPv6 traffic received, in bytes.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf dropped-ipv4-packets {
type yang:zero-based-counter64;
description
"Number of IPv4 packets dropped at the
Internet-facing interface.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf dropped-ipv4-bytes {
type yang:zero-based-counter64;
description
"IPv4 traffic dropped at the Internet-facing
interface, in bytes.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf dropped-ipv6-packets {
type yang:zero-based-counter64;
description
"Number of IPv4-in-IPv6 packets dropped.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf dropped-ipv6-bytes {
type yang:zero-based-counter64;
description
"IPv4-in-IPv6 traffic dropped, in bytes.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf dropped-ipv4-fragments {
type yang:zero-based-counter64;
description
"Number of fragmented IPv4 packets dropped.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf dropped-ipv4-fragment-bytes {
type yang:zero-based-counter64;
description
"Fragmented IPv4 traffic dropped, in bytes.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf ipv6-fragments-reassembled {
type yang:zero-based-counter64;
description
"Number of IPv6 fragments successfully reassembled.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf ipv6-fragments-bytes-reassembled {
type yang:zero-based-counter64;
description
"IPv6 fragments successfully reassembled, in bytes.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf out-icmpv4-error-packets {
type yang:zero-based-counter64;
description
"Internally generated ICMPv4 error packets.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf out-icmpv4-error-bytes {
type yang:zero-based-counter64;
description
"Internally generated ICMPv4 error messages, in bytes.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf out-icmpv6-error-packets {
type yang:zero-based-counter64;
description
"Internally generated ICMPv6 error packets.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
leaf out-icmpv6-error-bytes {
type yang:zero-based-counter64;
description
"Internally generated ICMPv6 error messages, in bytes.
Discontinuities in the value of this counter can occur
at re-initialization of the management system and at
other times as indicated by the value of
'discontinuity-time'.";
}
}
}
Security ConsiderationsThe YANG modules defined in this document are designed to be accessed
via network management protocols such as NETCONF or RESTCONF . The
lowest NETCONF layer is the secure transport layer, and the
mandatory-to-implement secure transport is Secure Shell (SSH) . The lowest RESTCONF layer is HTTPS, and the
mandatory-to-implement secure transport is TLS .The Network Configuration Access Control Model (NACM)
provides the means to restrict access for particular NETCONF or RESTCONF
users to a preconfigured subset of all available NETCONF or RESTCONF
protocol operations and content.All data nodes defined in the YANG modules which can be created,
modified, and deleted (i.e., config true, which is the default) are
considered sensitive. Write operations (e.g., edit-config) to
these data nodes without proper protection can have a negative
effect on network
operations. An attacker who is able to access the BR can undertake
various attacks, such as:
Setting the value of 'br-ipv6-addr' on the CE to point to an
illegitimate BR so that it can intercept all the traffic sent by a
CE. Illegitimately intercepting users' traffic is an attack with
severe implications on privacy.
Setting the MTU to a low value, which may increase the number of
fragments ('softwire-payload-mtu').
Disabling hairpinning (i.e., setting 'enable-hairpinning' to
'false') to prevent communications between CEs.
Setting 'softwire-num-max' to an arbitrary high value, which may
be exploited by a misbehaving user to perform a DoS on the binding
BR by mounting a massive number of softwires.
Setting 'icmpv4-rate' or 'icmpv6-rate' to a low value, which may
lead to the deactivation of ICMP messages handling.
Instructing the BR to install entries, which, in turn, will induce a
DDoS attack by means of the notifications generated by the BR. This
DDoS can be softened by defining a notification interval, but given
that this interval parameter can be disabled or set to a low value
by the misbehaving entity, the same problem will be observed.
Some of the readable data nodes in this YANG module may be considered
sensitive or vulnerable in some network environments. It is thus
important to control read access (e.g., via get, get-config, or notification)
to these data nodes. These subtrees and data nodes can be misused
to track the activity of a host:
the binding Table
(/br-instances/binding/bind-instance/binding-table)
the algorithm configuration (/br-instances/algorithm/algo-instance/)
Security considerations related to lw4o6, MAP-T, and MAP-E are
discussed in , , and respectively.Security considerations given in are
also applicable here.IANA ConsiderationsIANA has assigned the following new tunnel type under the
tunnelType subregistry of the "ifType Definitions" registry
maintained in the SMI Numbers registry :
Decimal:
18
Name:
aplusp
Description:
A+P encapsulation
Reference:
[RFC6346]
IANA has registered the following in the "ns"
subregistry within the "IETF XML Registry" :
URI:
urn:ietf:params:xml:ns:yang:ietf-softwire-ce
Registrant Contact:
The IESG.
XML:
N/A; the requested URI is an XML namespace.
URI:
urn:ietf:params:xml:ns:yang:ietf-softwire-br
Registrant Contact:
The IESG.
XML:
N/A; the requested URI is an XML namespace.
URI:
urn:ietf:params:xml:ns:yang:ietf-softwire-common
Registrant Contact:
The IESG.
XML:
N/A; the requested URI is an XML namespace.
IANA has registered the following YANG modules
in the "YANG Module Names" subregistry
within the "YANG Parameters" registry.
name:
ietf-softwire-ce
namespace:
urn:ietf:params:xml:ns:yang:ietf-softwire-ce
prefix:
softwire-ce
reference:
RFC 8676
name:
ietf-softwire-br
namespace:
urn:ietf:params:xml:ns:yang:ietf-softwire-br
prefix:
softwire-br
reference:
RFC 8676
name:
ietf-softwire-common
namespace:
urn:ietf:params:xml:ns:yang:ietf-softwire-common
prefix:
softwire-common
reference:
RFC 8676
ReferencesNormative ReferencesThe IETF XML RegistryThis document describes an IANA maintained registry for IETF standards which use Extensible Markup Language (XML) related items such as Namespaces, Document Type Declarations (DTDs), Schemas, and Resource Description Framework (RDF) Schemas.YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)YANG is a data modeling language used to model configuration and state data manipulated by the Network Configuration Protocol (NETCONF), NETCONF remote procedure calls, and NETCONF notifications. [STANDARDS-TRACK]Network Configuration Protocol (NETCONF)The Network Configuration Protocol (NETCONF) defined in this document provides mechanisms to install, manipulate, and delete the configuration of network devices. It uses an Extensible Markup Language (XML)-based data encoding for the configuration data as well as the protocol messages. The NETCONF protocol operations are realized as remote procedure calls (RPCs). This document obsoletes RFC 4741. [STANDARDS-TRACK]Using the NETCONF Protocol over Secure Shell (SSH)This document describes a method for invoking and running the Network Configuration Protocol (NETCONF) within a Secure Shell (SSH) session as an SSH subsystem. This document obsoletes RFC 4742. [STANDARDS-TRACK]Common YANG Data TypesThis document introduces a collection of common data types to be used with the YANG data modeling language. This document obsoletes RFC 6021.IANA Interface Type YANG ModuleThis document defines the initial version of the iana-if-type YANG module.Lightweight 4over6: An Extension to the Dual-Stack Lite ArchitectureDual-Stack Lite (DS-Lite) (RFC 6333) describes an architecture for transporting IPv4 packets over an IPv6 network. This document specifies an extension to DS-Lite called "Lightweight 4over6", which moves the Network Address and Port Translation (NAPT) function from the centralized DS-Lite tunnel concentrator to the tunnel client located in the Customer Premises Equipment (CPE). This removes the requirement for a Carrier Grade NAT function in the tunnel concentrator and reduces the amount of centralized state that must be held to a per-subscriber level. In order to delegate the NAPT function and make IPv4 address sharing possible, port-restricted IPv4 addresses are allocated to the CPEs.Mapping of Address and Port with Encapsulation (MAP-E)This document describes a mechanism for transporting IPv4 packets across an IPv6 network using IP encapsulation. It also describes a generic mechanism for mapping between IPv6 addresses and IPv4 addresses as well as transport-layer ports.DHCPv6 Options for Configuration of Softwire Address and Port-Mapped ClientsThis document specifies DHCPv6 options, termed Softwire46 options, for the provisioning of Softwire46 Customer Edge (CE) devices. Softwire46 is a collective term used to refer to architectures based on the notion of IPv4 Address plus Port (A+P) for providing IPv4 connectivity across an IPv6 network.Mapping of Address and Port using Translation (MAP-T)This document specifies the solution architecture based on "Mapping of Address and Port" stateless IPv6-IPv4 Network Address Translation (NAT64) for providing shared or non-shared IPv4 address connectivity to and across an IPv6 network.The YANG 1.1 Data Modeling LanguageYANG is a data modeling language used to model configuration data, state data, Remote Procedure Calls, and notifications for network management protocols. This document describes the syntax and semantics of version 1.1 of the YANG language. YANG version 1.1 is a maintenance release of the YANG language, addressing ambiguities and defects in the original specification. There are a small number of backward incompatibilities from YANG version 1. This document also specifies the YANG mappings to the Network Configuration Protocol (NETCONF).RESTCONF ProtocolThis document describes an HTTP-based protocol that provides a programmatic interface for accessing data defined in YANG, using the datastore concepts defined in the Network Configuration Protocol (NETCONF).Network Configuration Access Control ModelThe standardization of network configuration interfaces for use with the Network Configuration Protocol (NETCONF) or the RESTCONF protocol requires a structured and secure operating environment that promotes human usability and multi-vendor interoperability. There is a need for standard mechanisms to restrict NETCONF or RESTCONF protocol access for particular users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. This document defines such an access control model.This document obsoletes RFC 6536.A YANG Data Model for Interface ManagementThis document defines a YANG data model for the management of network interfaces. It is expected that interface-type-specific data models augment the generic interfaces data model defined in this document. The data model includes definitions for configuration and system state (status information and counters for the collection of statistics).The YANG data model in this document conforms to the Network Management Datastore Architecture (NMDA) defined in RFC 8342.This document obsoletes RFC 7223.The Transport Layer Security (TLS) Protocol Version 1.3This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery.This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations.A YANG Data Model for Tunnel Interface TypesStructure of Management Information (SMI) Numbers (MIB Module Registrations)IANAInformative ReferencesBasic Transition Mechanisms for IPv6 Hosts and RoutersThis document specifies IPv4 compatibility mechanisms that can be implemented by IPv6 hosts and routers. Two mechanisms are specified, dual stack and configured tunneling. Dual stack implies providing complete implementations of both versions of the Internet Protocol (IPv4 and IPv6), and configured tunneling provides a means to carry IPv6 packets over unmodified IPv4 routing infrastructures.This document obsoletes RFC 2893. [STANDARDS-TRACK]Dual-Stack Lite Broadband Deployments Following IPv4 ExhaustionThis document revisits the dual-stack model and introduces the Dual- Stack Lite technology aimed at better aligning the costs and benefits of deploying IPv6 in service provider networks. Dual-Stack Lite enables a broadband service provider to share IPv4 addresses among customers by combining two well-known technologies: IP in IP (IPv4- in-IPv6) and Network Address Translation (NAT). [STANDARDS-TRACK]The Address plus Port (A+P) Approach to the IPv4 Address ShortageWe are facing the exhaustion of the IANA IPv4 free IP address pool. Unfortunately, IPv6 is not yet deployed widely enough to fully replace IPv4, and it is unrealistic to expect that this is going to change before the depletion of IPv4 addresses. Letting hosts seamlessly communicate in an IPv4 world without assigning a unique globally routable IPv4 address to each of them is a challenging problem.This document proposes an IPv4 address sharing scheme, treating some of the port number bits as part of an extended IPv4 address (Address plus Port, or A+P). Instead of assigning a single IPv4 address to a single customer device, we propose to extend the address field by using bits from the port number range in the TCP/UDP header as additional endpoint identifiers, thus leaving a reduced range of ports available to applications. This means assigning the same IPv4 address to multiple clients (e.g., Customer Premises Equipment (CPE), mobile phones), each with its assigned port range. In the face of IPv4 address exhaustion, the need for addresses is stronger than the need to be able to address thousands of applications on a single host. If address translation is needed, the end-user should be in control of the translation process -- not some smart boxes in the core. This document defines an Experimental Protocol for the Internet community.Deterministic Address Mapping to Reduce Logging in Carrier-Grade NAT DeploymentsIn some instances, Service Providers (SPs) have a legal logging requirement to be able to map a subscriber's inside address with the address used on the public Internet (e.g., for abuse response). Unfortunately, many logging solutions for Carrier-Grade NATs (CGNs) require active logging of dynamic translations. CGN port assignments are often per connection, but they could optionally use port ranges. Research indicates that per-connection logging is not scalable in many residential broadband services. This document suggests a way to manage CGN translations in such a way as to significantly reduce the amount of logging required while providing traceability for abuse response. IPv6 is, of course, the preferred solution. While deployment is in progress, SPs are forced by business imperatives to maintain support for IPv4. This note addresses the IPv4 part of the network when a CGN solution is in use.YANG Tree DiagramsThis document captures the current syntax used in YANG module tree diagrams. The purpose of this document is to provide a single location for this definition. This syntax may be updated from time to time based on the evolution of the YANG language.Network Management Datastore Architecture (NMDA)Datastores are a fundamental concept binding the data models written in the YANG data modeling language to network management protocols such as the Network Configuration Protocol (NETCONF) and RESTCONF. This document defines an architectural framework for datastores based on the experience gained with the initial simpler model, addressing requirements that were not well supported in the initial model. This document updates RFC 7950.A YANG Data Model for IP ManagementThis document defines a YANG data model for management of IP implementations. The data model includes configuration and system state.The YANG data model in this document conforms to the Network Management Datastore Architecture defined in RFC 8342.This document obsoletes RFC 7277.A YANG Data Model for Routing Management (NMDA Version)This document specifies three YANG modules and one submodule. Together, they form the core routing data model that serves as a framework for configuring and managing a routing subsystem. It is expected that these modules will be augmented by additional YANG modules defining data models for control-plane protocols, route filters, and other functions. The core routing data model provides common building blocks for such extensions -- routes, Routing Information Bases (RIBs), and control-plane protocols.The YANG modules in this document conform to the Network Management Datastore Architecture (NMDA). This document obsoletes RFC 8022.A YANG Module for Network Address Translation (NAT) and Network Prefix Translation (NPT)This document defines a YANG module for the Network Address Translation (NAT) function.Network Address Translation from IPv4 to IPv4 (NAT44), Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers (NAT64), customer-side translator (CLAT), Stateless IP/ICMP Translation (SIIT), Explicit Address Mappings (EAM) for SIIT, IPv6-to-IPv6 Network Prefix Translation (NPTv6), and Destination NAT are covered in this document.A YANG Data Model for Dual-Stack Lite (DS-Lite)This document defines a YANG module for the Dual-Stack Lite (DS-Lite) Address Family Transition Router (AFTR) and Basic Bridging BroadBand (B4) elements.Configuration ExamplesThe following sections provide examples of how the softwire YANG
modules can be used for configuring softwire elements.Configuration Example for a lw4o6 BR Binding-TableThe lwAFTR maintains an address binding table that contains the
following 3-tuples:
IPv6 Address for a single lwB4
Public IPv4 Address
Restricted port-set
The entry has two functions: the IPv6 encapsulation of inbound IPv4
packets destined to the lwB4 and the validation of outbound
IPv4-in-IPv6 packets received from the lwB4 for decapsulation.Consider an example for the following lw4o6 binding table
entry:
lwB4 Binding IPv6 Address:
2001:db8::1
lwB4 Binding IPv4 Address:
192.0.2.1
lwB4 PSID:
0x34
lwB4 PSID Length
8
BR IPv6 Address:
2001:db8:1::2
Configuration Example for a MAP-E BRA MAP-E BR is configured with forward mapping rules for the CEs it
is serving. In this example (taken from , Appendix A, Example 2), the following
parameters are required:
Rule IPv6 Prefix
Rule IPv4 Prefix
Rule EA-bit bit length
IPv6 Address of MAP-BR
The mapping rule has two functions: identifying the destination CE
IPv6 address for encapsulating inbound IPv4 packets and the validation
of outbound IPv4-in-IPv6 packets received from the CE for
de-capsulation.The transport type for the data plane also needs to be configured
for encapsulation to enable MAP-E and forwarding needs to be
enabled.Consider an example for the following MAP-E Forwarding Mapping
Rule:
Data plane:
encapsulation
Rule IPv6 Prefix:
2001:db8::/40
Rule IPv4 Prefix:
192.0.2.0/24
Rule EA-bit Length:
16
BR IPv6 Address:
2001:db8:ffff::1
provides the example MAP-E
BR configuration xml.lw4o6 CE Configuration ExampleThis section provides XML examples for configuring a lw4o6 CE.
Examples for routing and NAT44 are also provided for convenience.Consider an example for the following lw4o6 CE configuration:
lwB4 Binding IPv6 Address:
2001:db8::1
lwB4 Binding IPv4 Address:
192.0.2.1
lwB4 PSID:
0x34
lwB4 PSID Length
8
BR IPv6 Address:
2001:db8:1::2
In the example depicted in , the interface name is defined
for the softwire tunnel. This name is then referenced by the routing
configuration for the IPv4 route. provides an example
configuration for the CE's IPv4 routing using the YANG module
described in . provides an example
configuration for the CE's NAPT44 function using the YANG module
described in .AcknowledgementsThe authors would like to thank Lishan Li, Bert Wijnen, Giles Heron,
Ole Troan, Andy Wingo, and Leo Tietz for their contributions to this
work.Thanks to Sheng Jiang for the review.Special thanks to Tom Petch and Martin Bjorklund for the detailed
review and suggestions.ContributorsThe following individuals are co-authors: Yong Cui
Tsinghua University
China
Phone: +86-10-6260-3059
Email: cuiyong@tsinghua.edu.cn
Qi Sun
Tsinghua University
China
Phone: +86-10-6278-5822
Email: sunqi.ietf@gmail.com
Linhui Sun
Tsinghua University
China
Phone: +86-10-6278-5822
Email: lh.sunlinh@gmail.com
Sladjana Zechlin
Deutsche Telekom AG
Germany
Email: sladjana.zechlin@telekom.de
Rajiv Asati
Cisco Systems, Inc.
United States of America
Email: Rajiva@cisco.com
Hao Wang
Tsinghua University
China
Phone: +86-10-6278-5822
Email: wangh13@mails.tsinghua.edu.cnAuthors' AddressesDeutsche Telekom AGCTO-ATI, Landgrabenweg 151BonnNRW53227Germanyian.farrer@telekom.deOrangeRennes35000Francemohamed.boucadair@orange.com