NGTRANS Working Group                                       F. Templin
INTERNET-DRAFT                                                   Nokia
                                                            T. Gleeson
                                                    Cisco Systems K.K.
                                                             M. Talwar
                                                             D. Thaler
                                                 Microsoft Corporation

Expires 18 April 2003                                  18 October 2002

        Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)


Status of this Memo

This document is an Internet-Draft and is in full conformance with all
provisions of Section 10 of RFC2026.

Internet-Drafts are working documents of the Internet Engineering Task
Force (IETF), its areas, and its working groups.  Note that other groups
may also distribute working documents as Internet- Drafts.

Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time.  It is inappropriate to use Internet- Drafts as reference material
or to cite them other than as "work in progress."

The list of current Internet-Drafts can be accessed at

The list of Internet-Draft Shadow Directories can be accessed at


   This document specifies the Intra-Site Automatic Tunnel Addressing
   Protocol (ISATAP) that connects IPv6 hosts and routers (nodes) within
   IPv4 sites. ISATAP is a transition mechanism that enables incremental
   deployment of IPv6 by treating the site's IPv4 infrastructure as a
   Non-Broadcast Multiple Access (NBMA) link layer for IPv6. ISATAP
   mechanisms use an IPv6 interface identifier format that embeds an
   IPv4 address - this enables automatic IPv6-in-IPv4 tunneling within a
   site, whether the site uses globally assigned or private IPv4
   addresses.  The new interface identifier format can be used with both
   local and global unicast IPv6 prefixes - this enables IPv6 routing
   both locally and globally. ISATAP mechanisms introduce no impact on

Templin, et. al.                  Expires 18 April 2003         [Page 1]

INTERNET-DRAFT                   ISATAP                  18 October 2002

   routing table size and require no special IPv4 services (e.g., IPv4

1.  Introduction

   This document presents a simple approach that enables incremental
   deployment of IPv6 within IPv4-based sites in a manner that is com-
   patible with inter-domain transition mechanisms, e.g., [6TO4]. We
   refer to this approach as the Intra-Site Automatic Tunnel Addressing
   Protocol, or ISATAP (pronounced: "ice-a-tap"). ISATAP allows dual-
   stack nodes that do not share a common link with an IPv6 router to
   automatically tunnel packets to the IPv6 next-hop address through
   IPv4, i.e., the site's IPv4 infrastructure is treated as an NBMA link

   This document specifies details for the transmission of IPv6 packets
   over ISATAP links (i.e., automatic IPv6-in-IPv4 tunneling), including
   a new EUI-64 [EUI64] based interface identifier [ADDR][AGGR] format
   that embeds an IPv4 address. This format supports configuration of
   global, site-local and link-local addresses as specified in [AUTO] as
   well as simple link-layer address mapping. Simple validity checks for
   received packets are given. Also specified in this document is the
   operation of IPv6 Neighbor Discovery for ISATAP, as permitted for
   NBMA links by [DISC]. The document finally presents deployment and
   security considerations for ISATAP.



   The current version of this specification embodies several opera-
   tional issues for anticipated deployment scenarios. These issues are
   clearly delineated in "starred" blocks such as this in the current
   document for now. They will be resolved in a new version of the spec-
   ification to be released in the near future.


2.  Applicability Statement

   ISATAP provides the following features:

     - treats site's IPv4 infrastructure as an NBMA link layer using
       automatic IPv6-in-IPv4 tunneling (i.e., no configured tunnel state)

     - enables incremental deployment of IPv6 hosts within IPv4 sites with

Templin, et. al.                  Expires 18 April 2003         [Page 2]

INTERNET-DRAFT                   ISATAP                  18 October 2002

       no aggregation scaling issues at border gateways

     - requires no special IPv4 services within the site (e.g., multicast)

     - supports both stateless address autoconfiguration and manual

     - supports networks that use non-globally unique IPv4 addresses (e.g.,
       when private address allocations [PRIVATE] are used), but does not
       allow the virtual ISATAP link to span a Network Address
       Translator [NAT]

     - compatible with other NGTRANS mechanisms (e.g., [6TO4])

3.  Terminology

   The terminology of [IPv6] applies to this document. The following
   additional terms are defined:

     same definition as [AUTO][DISC].

   underlying link:
     a link layer that supports IPv4 (for ISATAP), and MAY also support
     IPv6 natively.

   ISATAP link:
     one or more underlying links used for IPv4 tunneling. The IPv4
     network layer addresses of the underlying links are used as
     link-layer addresses on the ISATAP link.

   ISATAP interface:
     a node's attachment to an ISATAP link.

   ISATAP prefix:
     a prefix used to configure an address on the ISATAP interface. This
     prefix is administratively assigned to the ISATAP link and MUST NOT
     be duplicated on native IPv6 links.

   ISATAP address:
     an IPv6 address with an ISATAP prefix and an ISATAP format interface
     identifier constructed as specified in section 4.

   ISATAP router:
     an IPv6 node that has an ISATAP interface over which it forwards
     packets not explicitly addressed to itself.

Templin, et. al.                  Expires 18 April 2003         [Page 3]

INTERNET-DRAFT                   ISATAP                  18 October 2002

   ISATAP host:
     any node that has an ISATAP interface and is not an ISATAP router.

4.  Transmission of IPv6 Packets on ISATAP Links

   ISATAP links transmit IPv6 packets via automatic tunneling using the
   site's IPv4 infrastructure as an NBMA link layer. Automatic tunneling
   for ISATAP uses the same mechanisms specified in [MECH,3.1-3.6],
   i.e., IPv6 packets are automatically encapsulated in IPv4 using 'ip-
   protocol-41' as the payload type number.


   Operational Issue #1:

   The [MECH] document referenced above is currently undergoing a (bis)
   revision that will likely require future changes to the above text.


   Specific considerations for ISATAP links are given below:

4.1.  ISATAP Interface Identifier Construction

   IPv6 unicast addresses [ADDR][AGGR] include a 64-bit interface iden-
   tifier field in "modified EUI-64 format", based on the IEEE EUI-64
   [EUI64] specification. (Modified EUI-64 format inverts the sense of
   the 'u/l' bit from its specification in [EUI64], i.e., 'u/l' = 0
   indicates local-use.) ISATAP interface identifiers are constructed by
   prepending the 32-bit string '00-00-5E-FE' with an IPv4 address (see
   the following section for examples). Appendix B includes text
   explaining the historical basis for this construction rule.


   Operational Issue #2:

   The above construction rule unnecessarily wastes bits in the inter-
   face identifier that may be useful for other purposes.


Templin, et. al.                  Expires 18 April 2003         [Page 4]

INTERNET-DRAFT                   ISATAP                  18 October 2002

4.2.  Stateless Autoconfiguration and Link-Local Addresses

   ISATAP addresses are unicast addresses [ADDR,2.5] that use ISATAP
   format interface identifiers as follows:

    |           64 bits            |     32 bits   |    32 bits     |
    | link-local, site-local or    |   0000:5EFE   |  IPv4 Address  |
    |    global unicast prefix     |               | of ISATAP link |

   Link-local, site-local, and global ISATAP addresses can be created
   exactly as specified in [ADDR], (e.g., by auto-configuration [AUTO]
   or manual configuration). For example, the IPv6 address:


   has a prefix of '3FFE:1A05:510:1111::/64' and an ISATAP format inter-
   face identifier with embedded IPv4 address: ''.  The
   address is alternately written as:


   The link-local and site-local variants (respectively) are:


4.3.  ISATAP Link/Interface Configuration

   A node configures an ISATAP link over one or more underlying IPv4
   links, i.e., the ISATAP link MAY be configured over one or more link-
   layer (IPv4) addresses. Each link-layer address 'V4ADDR_LINK' is used
   to configure a link-local address 'FE80::0:5EFE:V4ADDR_LINK' on an
   ISATAP interface. ISATAP interfaces MAY be assigned one per link-
   layer address, or as a single interface for multiple link-layer

   In the former case, the address of each ISATAP interface SHOULD be
   added to the Potential Routers List (see section 5.2.1). In the lat-
   ter case, the interface will accept ISATAP packets addressed to any
   of the IPv4 link-layer addresses, but will choose one as its primary
   address, used for sourcing packets. Only this address need be repre-
   sented in the Potential Routers List.

Templin, et. al.                  Expires 18 April 2003         [Page 5]

INTERNET-DRAFT                   ISATAP                  18 October 2002

4.4.  Sending Rules and Address Mapping

   The IPv6 next-hop address for packets sent on an ISATAP link MUST be
   an ISATAP address. Packets that do not satisfy this constraint MUST
   be discarded and an ICMP destination unreachable indication with code
   3 (Address Unreachable) [ICMPv6] MUST be returned. No other sending
   rules are necessary.

   The procedure for mapping unicast addresses into link-layer addresses
   is to simply treat the last four octets of the ISATAP address as an
   IPv4 address (in network byte order). No multicast address mappings
   are specified.

4.5.  Validity Checks for Received Packets

   ISATAP interfaces MUST silently discard any received packets that do
   not satisfy at least one of the following validity checks:

     - the network-layer (IPv6) source address has a prefix configured on
       the ISATAP interface and an ISATAP-format interface identifier that
       embeds the link-layer (IPv4) source address, i.e., source is on-link

     - the link-layer (IPv4) source address is in the Potential Routers List
       (see section 5.2), i.e., previous hop is an on-link ISATAP router


   Operational Issue #3:

   The Potential Routers List gives no router reachabilty information.
   The second validity check above can lead to packets being accepted
   from nodes claiming to be routers, but for which the accepting node
   has no affiliation.


5.  Neighbor Discovery for ISATAP Links

   Section 3.2 of [DISC] ("Supported Link Types") provides the following
   guidelines for non-broadcast multiple access (NBMA) link support:

     "Redirect, Neighbor Unreachability Detection and next-hop determi-
     nation should be implemented as described in this document. Address
     resolution and the mechanism for delivering Router Solicitations
     and Advertisements on NBMA links is not specified in this docu-

Templin, et. al.                  Expires 18 April 2003         [Page 6]

INTERNET-DRAFT                   ISATAP                  18 October 2002

   ISATAP links SHOULD implement Redirect, Neighbor Unreachability
   Detection, and next-hop determination exactly as specified in [DISC].
   Address resolution and the mechanisms for delivering Router Solicita-
   tions and Advertisements for ISATAP links are not specified by
   [DISC]; instead, they are specified in this document. (Note that
   these mechanisms MAY potentially apply to other types of NBMA links
   in the future.)

5.1.  Address Resolution

   Protocol addresses (IPv6) in ISATAP are resolved to link-layer
   addresses (IPv4) by a static computation, i.e., the last four octets
   are treated as an IPv4 address. Thus the functions and conceptual
   data structures used by [DISC] for the purpose of address resolution
   are not required. The conceptual "neighbor cache" described in [DISC]
   is still needed for other functions, such as neighbor unreachability
   detection, but it is not used for address resolution.


   Operational Issue #4.1:

   The static computation used for address resolution on ISATAP links
   does not trigger neighbor reachability detection as specified in
   [DISC, 7.3.3], leading to possible black holes.


   The link-layer address option used in [DISC] is not needed. Link-
   layer address options SHOULD NOT be sent in any Neighbor Discovery
   packets, and MUST be silently ignored in any received Neighbor Dis-
   covery packets.

5.2.  Router and Prefix Discovery

   Since the site's IPv4 infrastructure is treated as an NBMA link
   layer, unsolicited Router Advertisements do not provide sufficient
   means for router discovery on ISATAP links. Thus, alternate mecha-
   nisms are required and specified below:

5.2.1.  Conceptual Data Structures

   ISATAP nodes use the conceptual data structures Prefix List and
   Default Router List exactly as specified in [DISC,5.1]. ISATAP links
   add a new conceptual data structure "Potential Router List" and the

Templin, et. al.                  Expires 18 April 2003         [Page 7]

INTERNET-DRAFT                   ISATAP                  18 October 2002

   following new configuration variable:

     ResolveInterval    Time between name service resolutions.
                        Default and suggested minimum: 1hr

   A Potential Router List (PRL) is associated with every ISATAP link.
   The PRL provides context for router discovery and a trust basis for
   router validation (see security considerations). Each entry in the
   PRL has an IPv4 address and an associated timer used for polling. The
   IPv4 address represents a router's ISATAP interface (likely to be an
   "advertising interface"), and is used to construct the ISATAP link-
   local address for that interface.

   When a node enables an ISATAP link, it initializes the Potential
   Router List (PRL) for that link. Unless other information is avail-
   able (e.g., manual address configuration, a vendor-specific DHCP
   option, etc.) the following method (similar to the [SIP, 1.4.2] pro-
   cedure) SHOULD be used:

     1. The site administrator maintains address records for ISATAP
        router interfaces, and makes these available in the site's
        name service. Nodes attempt to find one or more addresses
        for the PRL by querying the name service.

     2. There are no mandatory rules on the selection of domain name
        to be used within a site for this purpose, but administrators
        are encouraged to use the "isatap.domainname" convention
        (e.g.,, as specified in [RFC2219]. Nodes
        can construct this domain name by prepending the label "isatap"
        to their parent domain name, which is established by other
        means. Nodes then query this domain name for address records
        (e.g., DNS 'A' resource records), and initialize the PRL with
        the IPv4 addresses in the replies.

     3. After initialization, nodes periodically repeat the above
        procedure every ResolveInterval seconds to update the PRL with
        any IPv4 addresses added/deleted since the previous iteration.
        When DNS is used, nodes MUST follow the procedures in [RFC1035]
        regarding cache invalidation when the DNS time-to-live expires.

5.2.2.  Validation of Router Advertisement Messages

   A node MUST silently discard any received Router Advertisement mes-
   sages that do not satisfy the validity checks in [DISC,6.1.2] as well
   as the following additional validity check for ISATAP:

        - the network-layer (IPv6) source address is derived from
          an IPv4 address in the PRL

Templin, et. al.                  Expires 18 April 2003         [Page 8]

INTERNET-DRAFT                   ISATAP                  18 October 2002

5.2.3.  Router Specification

   Advertising ISATAP interfaces of routers behave the same as advertis-
   ing interfaces described in [DISC,6.2]. However, periodic unsolicited
   multicast Router Advertisements are not required, thus the "interval
   timer" associated with advertising interfaces is not used for that

   When an ISATAP router receives a valid Router Solicitation on an
   advertising ISATAP interface, it replies with a unicast Router Adver-
   tisement to the address of the node which sent the Router Solicita-
   tion. The source address of the Router Advertisement is a link-local
   unicast address associated with the interface. This MAY be the same
   as the destination address of the Router Solicitation. ISATAP routers
   MAY engage in the polling process described under Host Specification
   below (e.g. if Router Advertisement consistency verification
   [DISC,6.2.7] is desired), but this is not required.

5.2.4.  Host Specification

   Hosts periodically poll each entry in the PRL ("PRL(i)") by sending
   unicast Router Solicitation messages using the IPv4 address
   ("V4ADDR_PRL(i)") and associated timer in the entry. Hosts add the
   following variable to support the polling process:

                   Minimum time between sending Router Solicitations
                   to any router. Default and suggested minimum: 15min

   When PRL(i) is first added to the list, the host sets its associated
   timer to MinRouterSolicitInterval.

   Entries are polled when they are created (following a short delay as
   for initial solicitations [ND,6.3.7]), and when the associated timer

   Polling consists of sending Router Solicitations to the ISATAP link-
   local address constructed from the entry's IPv4 address, i.e., they
   are sent to 'FE80::0:5EFE:V4ADDR_PRL(i)' instead of 'All-Routers mul-
   ticast'. They are otherwise sent in the same manner described in

   When the host receives a valid Router Advertisement (i.e., one that
   satisfies the validity checks in sections 4.5 and 5.2.2) it processes
   them in the same manner described in [DISC,6.3.4]. The host addition-
   ally resets the timer associated with the PRL entry that matches the
   network-layer source address in the Router Advertisement. The timer

Templin, et. al.                  Expires 18 April 2003         [Page 9]

INTERNET-DRAFT                   ISATAP                  18 October 2002

   is reset to either 0.5 * (the minimum value in the router lifetime or
   valid lifetime of any on-link prefixes advertised) or MinRouterSolic-
   itInterval; whichever is longer.


   Operational Issue #4.2:

   The Router and Host specifications above effectively treat the IPv4
   path as a single IPv6 hop. The host caches link state information for
   the hop, but the link is unidirectional (from the host to the router)
   and subject to change due to network topology fluctuations. The
   router caches no information, thus has no level of assurance that the
   host will receive critical ICMPv6 messages, e.g., ICMPv6 Packet Too



   Operational Issue #5:

   Solutions to 4.1 and 4.2 above may impart control message overhead
   explosion if hosts are to poll all routers in the PRL as currently
   suggested above.


6.  ISATAP Deployment Considerations

6.1.  Host And Router Deployment Considerations

   For hosts, if an underlying link supports both IPv4 (over which ISA-
   TAP is implemented) and also supports IPv6 natively, then ISATAP MAY
   be enabled if the native IPv6 layer does not receive Router Adver-
   tisements (i.e., does not have connection with an IPv6 router). After
   a non-link-local address has been configured and a default router
   acquired on the native link, the host SHOULD discontinue the 'Router
   Polling Process' process specified in section 5.2.4 and allow exist-
   ing ISATAP address configurations to expire as specified in
   [DISC,5.3][AUTO,5.5.4]. In this way, ISATAP use will gradually dimin-
   ish as IPv6 routers are widely deployed throughout the site.

   Routers MAY configure a native link to simultaneously support both
   native IPv6, and also ISATAP (over IPv4). Routing will operate as

Templin, et. al.                 Expires 18 April 2003         [Page 10]

INTERNET-DRAFT                   ISATAP                  18 October 2002

   usual between these two domains. Note that the prefixes used on the
   ISATAP and native IPv6 interfaces will be distinct. The IPv4
   address(es) configured on a router's ISATAP interface(s) SHOULD be
   added (either automatically or manually) to the site's address
   records for ISATAP router interfaces (see section 5.2.1).

6.2.  Site Administration Considerations

   The following considerations are noted for sites that deploy ISATAP:

     - ISATAP links are administratively defined by a set of router
       interfaces, and set of nodes which have those interface addresses
       in their potential router lists. Thus, ISATAP links are defined by
       administrative (not physical) boundaries.

     - ISATAP hosts and routers can be deployed in an ad-hoc and independent
       fashion. In particular, ISATAP hosts can be deployed with little/no
       advanced knowledge of existing ISATAP routers, and ISATAP routers
       can deployed with no reconfiguration requirements for hosts.

     - ISATAP nodes periodically send Router Solicitations to all entries
       in the Potential Router List. Worst-case control traffic is on the
       order of (M x N), where 'M' is the number of routers in the Potential
       Router List and 'N' is the total number of nodes on the ISATAP link.
       The MinRouterSolicitInterval ([5.2.4]) bounds control traffic for
       large numbers of nodes even in worst-case scenarios.

     - ISATAP nodes periodically refresh the entries on the PRL, typically
       by polling the DNS. Responsible site administration can reduce the
       control traffic. At a minimum, administrators SHOULD ensure that
       the site's address records for ISATAP router interfaces (see
       section 5.2.1) are well maintained.


   Operational Issue #6:

   Sites may enable Network Address Translators (NATs) internally, but
   most NATs work only for UDP/IPv4 and TCP/IPv4 packets. ISATAP uses
   IPv6/IPv4 encapsulation, and may encounter operational problems in
   sites that deploy NATs internally.


Templin, et. al.                 Expires 18 April 2003         [Page 11]

INTERNET-DRAFT                   ISATAP                  18 October 2002

7.  IANA considerations

   Appendix B gives historical considerations for managing the IEEE OUI
   assigned to IANA for EUI-64 interface identifier construction.  These
   considerations are noted and made freely available to IANA for any
   purpose they may find useful.

8.  Security considerations

   Site administrators are advised that, in addition to possible attacks
   against IPv6, security attacks against IPv4 MUST also be considered.
   Many security considerations in [6OVER4,9] apply also to ISATAP.

   Responsible IPv4 site security management is strongly encouraged. In
   particular, border gateways SHOULD implement filtering to detect
   spoofed IPv4 source addresses at a minimum; ip-protocol-41 filtering
   SHOULD also be implemented.

   If IPv4 source address filtering is not correctly implemented, the
   validity checks in section 4.7 will not be effective in preventing
   IPv6 source address spoofing.

   If filtering for ip-protocol-41 is not correctly implemented, IPv6
   source address spoofing is clearly possible, but this can be elimi-
   nated if both IPv4 source address filtering, and the validity checks
   in section 4.7 are implemented.

   [DISC,6.1.2] implies that nodes trust Router Advertisements they
   receive from on-link routers, as indicated by a value of 255 in the
   IPv6 'hop-limit' field. Since this field is not decremented when ip-
   protocol-41 packets traverse multiple IPv4 hops [MECH,3.3], ISATAP
   links require a different trust model. In particular, ONLY those
   Router Advertisements received from a member of the Potential Routers
   List are trusted; all others are silently discarded (see section
   5.2.2). This trust model is predicated on IPv4 source address filter-
   ing, as described above.


   Operational Issue #7:

   The above trust basis specification incurs the same issue identified
   in "Operational Issue #3.


   The ISATAP address format does not support privacy extensions for

Templin, et. al.                 Expires 18 April 2003         [Page 12]

INTERNET-DRAFT                   ISATAP                  18 October 2002

   stateless address autoconfiguration [PRIVACY]. However, since the
   ISATAP interface identifier is derived from the node's IPv4 address,
   ISATAP addresses do not have the same level of privacy concerns as
   IPv6 addresses that use an interface identifier derived from the MAC


   Some of the ideas presented in this draft were derived from work at
   SRI with internal funds and contractual support. Government sponsors
   who supported the work include Monica Farah-Stapleton and Russell
   Langan from U.S. Army CECOM ASEO, and Dr. Allen Moshfegh from U.S.
   Office of Naval Research. Within SRI, Dr. Mike Frankel, J. Peter Mar-
   cotullio, Lou Rodriguez, and Dr. Ambatipudi Sastry supported the work
   and helped foster early interest.

   The following peer reviewers are acknowledged for taking the time to
   review a pre-release of this document and provide input: Jim Bound,
   Rich Draves, Cyndi Jung, Ambatipudi Sastry, Aaron Schrader, Ole
   Troan, Vlad Yasevich.

   The authors acknowledge members of the NGTRANS community who have
   made significant contributions to this effort, including Rich Draves,
   Alain Durand, Nathan Lutchansky, Art Shelest, Margaret Wasserman, and
   Brian Zill.

   The authors wish to acknowledge the work of Quang Nguyen [VET] under
   the guidance of Dr. Lixia Zhang that proposed very similar ideas to
   those that appear in this document. This work was first brought to
   the authors' attention on September 20, 2002.

   Finally, the authors recognize that ideas similar to those in this
   document may have already been presented by others and wish to
   acknowledge any other such contributions.

Normative References

   [ADDR]     Hinden, R., and S. Deering, "IP Version 6 Addressing
              Architecture", RFC 2373, July 1998. (Pending approval
              of "addr-arch-v3").

   [AGGR]     Hinden., R, O'Dell, M., and Deering, S., "An IPv6
              Aggregatable Global Unicast Address Format",
              RFC 2374, July 1998.

   [AUTO]     Thomson, S., and T. Narten, "IPv6 Stateless Address
              Autoconfiguration", RFC 2462, December 1998.

Templin, et. al.                 Expires 18 April 2003         [Page 13]

INTERNET-DRAFT                   ISATAP                  18 October 2002

   [DISC]     Narten, T., Nordmark, E., and W. Simpson, "Neighbor
              Discovery for IP Version 6 (IPv6)", RFC 2461,
              December 1998.

   [EUI64]    IEEE, "Guidelines for 64-bit Global Identifier (EUI-64)
              Registration Authority",
              March 1997.

   [ICMPv6]   Conta, A. and S. Deering, "Internet Control Message
              Protocol (ICMPv6) for the Internet Protocol Version 6
              (IPv6) Specification", RFC 2463, December 1998.

   [IPV4]     Postel, J., "Internet Protocol", RFC 791.

   [IPV6]     Deering, S., and R. Hinden, "Internet Protocol, Version 6
              (IPv6) Specification", RFC 2460.

   [MECH]     Gilligan, R., and E. Nordmark, "Transition Mechanisms for
              IPv6 Hosts and Routers", RFC 2893, August 2000.

   [NAT]      Egevang, K., and P. Francis, "The IP Network Address
              Translator (NAT)", RFC 1631, May 1994.

   [PRIVATE]  Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.,
              and E. Lear, "Address Allocation for Private Internets",
              RFC 1918, February 1996.

   [SIP]      Handley, M., Schulzrinne, H., Schooler, E., and
              J. Rosenberg, "SIP: Session Initiation Protocol",
              RFC 2543, March 1999.

Informative References

   [6OVER4]   Carpenter, B. and C. Jung, "Transmission of IPv6 over IPv4
              Domains without Explicit Tunnels", RFC 2529.

   [6TO4]     Carpenter, B., and K. Moore, "Connection of IPv6 Domains
              via IPv4 Clouds", RFC 3056, February 2001.

   [IANA]     Reynolds, J., and J. Postel, "Assigned Numbers", STD 2,
              USC/Information Sciences Institute, October 1994.

   [PRIVACY]  Narten, T., R. Draves, "Privacy Extensions for Stateless
              Address Autoconfiguration in IPv6", RFC 3041,
              January 2001.

Templin, et. al.                 Expires 18 April 2003         [Page 14]

INTERNET-DRAFT                   ISATAP                  18 October 2002

   [RFC1035]  Mockapetris, P., "Domain Names - Implementation and
              Specification", RFC 1035, November 1987.

   [RFC2219]  Hamilton, M., and R. Wright, "Use of DNS Aliases for
              Network Services", RFC 2219 (BCP), October 1997.

   [VET]      Nguyen, Quang, "Virtual Ethernet: A New Approach to
              IPv6 Transition",,
              MS Project Report, Spring 1998.

Authors Addresses

      Fred L. Templin
      313 Fairchild Drive
      Mountain View, CA, USA
      Phone: (650)-625-2331

      Tim Gleeson
      Cisco Systems K.K.
      Shinjuku Mitsu Building
      2-1-1 Nishishinjuku, Shinjuku-ku
      Tokyo 163-0409, JAPAN

      Mohit Talwar
      Microsoft Corporation
      One Microsoft Way
      Redmond, WA  98052-6399
      Phone: +1 425 705 3131

      Dave Thaler
      Microsoft Corporation
      One Microsoft Way
      Redmond, WA  98052-6399
      Phone: +1 425 703 8835

APPENDIX A: Major Changes

   changes from version 04 to version 05:

     - Moved historical text in section 4.1 to Appendix B in
       response to comments from Pekka Savola

     - Identified operational issues for anticipated deployment

Templin, et. al.                 Expires 18 April 2003         [Page 15]

INTERNET-DRAFT                   ISATAP                  18 October 2002


     - Included SRI IPR statement and contact information

     - Included reference to Quang Nguyen work

   changes from version 03 to version 04:

     - Re-wrote section on Potential Router List initialization to
       reference existing precedence in other documents

     - several minor wording changes based on feedback from the

   changes from version 02 to version 03:

     - Added contributing co-authors

     - RSs are now sent to unicast addresses rather than all-routers-multicast

     - Brought draft into better alignment with other IPv6
       standards-track documents

     - Added applicability statement

   changes from version 01 to version 02:

     - Cleaned up text and tightened up terminology. Changed "IPv6 destination
       address" to "IPv6 next-hop address" under "sending rules". Changed
       definition of ISATAP prefix to include link and site-local. Changed
       language in sections 4 and 5

   changes from version 00 to version 01:

     - Revised draft to require different /64 prefixes for ISATAP
       addresses and native IPv6 addresses. Thus, a node's ISATAP
       interface is assigned a /64 prefix that is distinct from the
       prefixes assigned to any other interfaces attached to the
       node - be they physical or logical interfaces. This approach
       eliminates ISATAP-specific sending rules presented in earlier
       draft versions.

     - Changed sense of 'u/l' bit in the ISATAP address interface
       identifier to indicate "local scope", since ISATAP interface
       identifiers are unique only within the scope of the ISATAP
       prefix. (See section 4.)

Templin, et. al.                 Expires 18 April 2003         [Page 16]

INTERNET-DRAFT                   ISATAP                  18 October 2002

   changes from personal draft to version 00:

     - Title change to provide higher-level description of field of
       use addressed by this draft. Removed other extraneous text.

     - Major new section on automatic discovery of off-link IPv6 routers
       when IPv6-IPv4 compatibility addresses are used.

APPENDIX B: Historical Interface Identifier Construction Rules

   ISATAP specifies an [EUI64]-format address construction for the Orga-
   nizationally-Unique Identifier (OUI) owned by the Internet Assigned
   Numbers Authority [IANA]. This format (given below) is used to con-
   struct both native [EUI64] addresses for general use and modified
   EUI-64 format interface identifiers for use in IPv6 unicast

    |0                      2|2      3|3      3|4                      6|
    |0                      3|4      1|2      9|0                      3|
    |  OUI ("00-00-5E"+u+g)  |  TYPE  |  TSE   |          TSD           |

   Where the fields are:

      OUI     IANA's OUI: 00-00-5E with 'u' and 'g' bits (3 octets)

      TYPE    Type field; specifies interpretation of (TSE, TSD) (1 octet)

      TSE     Type-Specific Extension (1 octet)

      TSD     Type-Specific Data (3 octets)

   And the following interpretations are specified based on TYPE:

      TYPE         (TSE, TSD) Interpretation
      ----         -------------------------
      0x00-0xFD    RESERVED for future IANA use
      0xFE         (TSE, TSD) together contain an embedded IPv4 address
      0xFF         TSD is interpreted based on TSE as follows:

                   TSE          TSD Interpretation
                   ---          ------------------
                   0x00-0xFD    RESERVED for future IANA use
                   0xFE         TSD contains 24-bit EUI-48 intf id
                   0xFF         RESERVED by IEEE/RAC

   Thus, if TYPE=0xFE, TSE is an extension of TSD. If TYPE=0xFF, TSE is

Templin, et. al.                 Expires 18 April 2003         [Page 17]

INTERNET-DRAFT                   ISATAP                  18 October 2002

   an extension of TYPE. Other values for TYPE (hence, other interpreta-
   tions of TSE, TSD) are reserved for future IANA use.

   The above specification is compatible with all aspects of [EUI64],
   including support for encapsulating legacy EUI-48 interface identi-
   fiers (e.g., an IANA EUI-48 format multicast address such as:
   '01-00-5E-01-02-03' is encapsulated as: '01-00-5E-FF-FE-01-02-03').
   But, the specification also provides a special TYPE (0xFE) to indi-
   cate an IPv4 address is embedded. Thus, when the first four octets of
   a [ADDR]-compatible IPv6 interface identifier are: '00-00-5E-FE'
   (note: the 'u/l' bit MUST be 0) the interface identifier is said to
   be in "ISATAP format" and the next four octets embed an IPv4 address
   encoded in network byte order.


   SRI International has sent the following message to the IETF Execu-
   tive Director (Steve Coya) regarding intellectual property rights.
   (An auto-reply from Steve Coya's mailer also appears below.) Please
   direct all inquiries regarding intellectual property rights pertain-
   ing to this document to the contact given in the message below:

     Date: Tue, 15 Oct 2002 15:37:47 -0700
     From: Peter Marcotullio <>
     Subject: Revised IPR statement

     Dear Mr. Coya,
     Please replace SRI's previous IPR statement for the ISATAP Draft "ISI
     patent statement pertaining to draft-ietf-ngtrans-isatap" (by the way the
     previous statement was mislabeled as "ISI" when it should have been "SRI
     International") with the following:

     SRI International Patent statement pertaining to draft-ietf-ngtrans-isatap

     Statement for 'draft-ietf-ngtrans-isatap-04.txt':
     Patent Rights Statement. SRI International has filed one or more patent
     applications pertaining to aspects of this submission. SRI grants
     royalty-free permission under such applications and resulting patents for
     both commercial and non-commercial uses, for development of and compliance
     with IETF standardization purposes. Any aspects or variants of SRI's
     submission or intellectual property that are not included in IETF
     standards and/or are not necessary for compliance with IETF standards may
     require an additional license from SRI under terms to be negotiated by the

     Please feel free to contact me if you have any questions or comments.

Templin, et. al.                 Expires 18 April 2003         [Page 18]

INTERNET-DRAFT                   ISATAP                  18 October 2002

     Peter Marcotullio

     Please note that this revised IPR statement expands the rights that SRI is
     granting to the IETF community.

     Peter Marcotullio
     Director, Business Development
     Information, Telecommunications and Automation Division
     SRI International
     333 Ravenswood Ave.
     Menlo Park, CA 94025
     +1 650.859.5457
     +1 650.859.4812 fax

     Date: Tue, 15 Oct 2002 18:35:46 -0400 (EDT)
     From: Steve Coya <>
     Subject: Gone again
     X-Spam-Status: No, score=0.7 threshold=6.0
     X-Spam-Level: x

     Hi, this is Steve Coya's mail account.

     Steve is out of the office and will not return until Tuesday,
     October 22.  He will NOT be able to respond to email during that

     I will make Steve read your message regarding "Revised IPR statement" when he
     returns (though replies may take longer - sigh).

     Thanks for your patience and understanding.

Templin, et. al.                 Expires 18 April 2003         [Page 19]