RFC 9313: transition mechanisms for IPv6-mostly networks
NSA advises against everything except NAT64/DNS64 and 464XLAT
NSA advises against everything except NAT64/DNS64 and 464XLAT
Although a dual-stack set-up remains the conventional way of offering both IPv4 and IPv6 connectivity to home and network users, it isn't viable for major mobile service providers. Because of the shortage of IPv4 addresses, such providers rely on IPv6-only access networks, combined with IPv4-IPv6 transition mechanisms to enable customers to access services that only support IPv4. Network specialist Ondřej Caletka calls such set-ups 'IPv6-mostly networks'.
RFC 9313 refers to the approach described above as 'IPv4-as-a-Service' (IPv4aaS), and presents 5 transition mechanisms for providing mobile users with IPv4 access. In the second part of the RFC, the authors set out the characteristics of and differences between the 5 mechanisms. Network operators may find it helpful to consult the information when considering which transition mechanism to use for their infrastructures.
The 5 transition mechanisms that RFC 9313 identifies as useful for making IPv4 services accessible to mobile users on IPv6-only access networks are:
Dual-Stack Lite (DS-Lite)
Lightweight 4over6 (lw4over6)
Mapping of Address and Port with Encapsulation (MAP-E)
Mapping of Address and Port using Translation (MAP-T)
The authors discuss the 5 mechanisms in section 2 of the RFC. However, for a more accessible explanation, we advise looking at the relevant items in our IPv6 FAQ utility (see the items linked in the list above).
RFC 6180 (an entirely different document from RFC 9313!) covers the use of IPv4-IPv6 transition mechanisms in general. Of the 4 scenarios discussed, the third (dealt with in section 4.3) involves providing IPv4 access over IPv6-only networks. The RFC recommends using DS-Lite for that purpose.
However, RFC 6180 is now more than 10 years old, and therefore dates from a time when more modern transition mechanisms (typically based on translation, rather than tunnelling) were unavailable. We therefore advise referring to this RFC only for the general guidance and principles.
In our IPv6 FAQ utility, we provide an extensive schematic overview of all relevant IPv4-IPv6 transition mechanisms. As you'll see, we've classed all the mechanisms on the left (in grey) as legacy mechanisms. In other words, we don't advise using them any longer.
(Click image to enlarge.)
We've provided a separate overview of the contemporary mechanisms listed on the right (in green). As you'll see, the 5 mechanisms considered in RFC 9313 are the same 5 included in our overview.
(Click image to enlarge.)
The IPv6 Security Guidance that was recently published by the US National Security Agency (NSA) suggests that the shortlist could be reduced still further. For security reasons, the NSA advises against using protocols that rely on tunnelling and translation, mainly because of their complexity and security. An exception is made in relation to NAT64/DNS64 and 464XLAT in IPv6-only networks (note that 464XLAT builds upon the other 2 techniques). An important objection to tunnelling is that a tunnel bypasses the security of the network perimeter – firewalls, screening routers, etc.
However, we would caution against discounting the other 4 mechanisms. They have become established because they have characteristics that make them suitable for particular types of environment. The points made in RFC 9313 should therefore be considered with your own network environment and requirements in mind.
The characteristics of and differences between the 5 transition mechanisms are addressed in the second part of RFC 9313 (section 3 and following). Although the use of NAT64/DNS64 and 464XLAT should be assumed, we advise network operators and architects who need to provide their IPv6-only users with IPv4aaS to study those sections of the RFC, and to consider whether any of the other mechanisms covered could be more suitable in their particular circumstances.