NETEXT WG S. Gundavelli, Ed. Internet-Draft Cisco Intended status: Standards Track X. Zhou Expires: April 24, 2013 ZTE Corporation J. Korhonen Nokia Siemens Networks G. Feige R. Koodli Cisco October 21, 2012 IPv4 Traffic Offload Selector Option for Proxy Mobile IPv6 draft-ietf-netext-pmipv6-sipto-option-07.txt Abstract This specification defines a traffic offload mechanism and a related mobility option for carrying IPv4 Offload traffic selectors between a mobile access gateway and a local mobility anchor in a Proxy Mobile IPv6 domain. Based on the negotiated IPv4 traffic offload flow selectors with the local mobility anchor, a mobile access gateway can enable offload traffic rule on the selected IPv4 flows. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on April 24, 2013. Copyright Notice Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents Gundavelli, et al. Expires April 24, 2013 [Page 1] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Conventions and Terminology . . . . . . . . . . . . . . . . . 4 2.1. Conventions . . . . . . . . . . . . . . . . . . . . . . . 4 2.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4 3. Solution Overview . . . . . . . . . . . . . . . . . . . . . . 5 3.1. LMA Considerations . . . . . . . . . . . . . . . . . . . . 7 3.2. MAG Considerations . . . . . . . . . . . . . . . . . . . . 8 4. IPv4 Traffic Offload Selector Option . . . . . . . . . . . . . 9 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 6. Protocol Configuration Variables . . . . . . . . . . . . . . . 11 7. Security Considerations . . . . . . . . . . . . . . . . . . . 12 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 12 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 13 9.1. Normative References . . . . . . . . . . . . . . . . . . . 13 9.2. Informative References . . . . . . . . . . . . . . . . . . 13 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 13 Gundavelli, et al. Expires April 24, 2013 [Page 2] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 1. Introduction Mobile Operators are expanding their network coverage by integrating various access technology domains (Ex: Wireless LAN, CDMA, LTE) into a common IP mobility core. The 3GPP S2a Proxy Mobile IPv6 [TS23402] reference point, specified by the 3GPP system architecture defines the protocol inter-working for building such integrated multi-access network. In this scenario, the mobile node's IP traffic is always tunneled back from the mobile access gateway [RFC5213] in the access network to the local mobility anchor in the home network. Currently, there is no mechanism for allowing some of the subscriber's IP flows to be offloaded in the access network. With the exponential growth in the mobile data traffic, mobile operators are exploring new ways to offload some of the IP traffic flows at the nearest access edge. The offload is intended either for local service access in the access network, or for internet offload through the access network when there is an internet peering point. Not all IP traffic flows needs to be routed back to the home network, some of the non-essential traffic which does not require IP mobility support can be offloaded at the mobile access gateway in the access network. This approach allows efficient usage of the mobile packet core which helps in lowering transport costs. The local mobility anchor in the home network can deliver the IP flow policy to the mobile access gateway in the access network, for identifying the IP flows that need to be offloaded. Example of such non-essential traffic is entirely a policy decision. A given operator may choose to offload all traffic except that which requires QoS services (Ex: Voice over IP traffic), or may choose to offload all HTTP traffic. From the point of view of this specification, its only about IPv4 traffic matching a given flow selector and classification for offload. This approach has one limitation with respect to identifying encrypted traffic. IPsec encrypted traffic with no visibility into the application payload cannot be selected for offload. This document defines a new mobility option, IPv4 Traffic Offload Selector option for Proxy Mobile IPv6 (PMIPv6). This option can be used by the local mobility anchor for delivering the IPv4 traffic offload policy associated with a mobility session to the mobile access gateway. This IPv4 traffic offload policy identifies the flow selectors that can used for selecting the flows for offloading them at the access edge. Since, the mobile node's IP address topologically belongs to the home network, the offloaded IPv4 traffic flows may need to be NAT [RFC2663] translated. These offloaded flows will not have mobility support as the NAT becomes the anchor point for those flows. However, when the traffic is offloaded for local service access as opposed to internet offload, NAT translation may Gundavelli, et al. Expires April 24, 2013 [Page 3] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 not be needed, if the mobile access gateways is in path for the return traffic. The decision on when to apply NAT translation can be based on local configuration on the mobile access gateway. There are better ways to address the offload problem for IPv6 and with the goal not to create NAT66 requirement, this specification therefore does not support traffic offload support for IPv6 flows. An IPv6 enabled mobile node can be assigned multiple IPv6 prefixes, some from the access network and the other from the home network. If there is proper prefix coloring marking in the Router Advertisement messages which allows the mobile node to identify the IPv6 prefix assigned from the local access network, it can choose to use an address from that prefix for IP traffic flows that require offload. There is active work in IETF for addressing the prefix coloring related enhancements. This document also does not define any new semantics for flow selectors. The flow identification and the related semantics are all leveraged from [RFC6088] and [RFC6089]. 2. Conventions and Terminology 2.1. Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 2.2. Terminology All the mobility related terms used in this document are to be interpreted as defined in the base Proxy Mobile IPv6 specifications [RFC5213] and [RFC5844]. Additionally, this document uses the following abbreviations: IP Flow IP Flow represents a set of IP packets that match a traffic selector. The selector is typically based on the source IP address, destination IP address, source port, destination port and other fields in upper layer headers. IP Traffic Offload The approach of selecting specific IP flows and routing them through the access network, instead of tunneling them to the home network. Offload can also be between two access networks (Example: moving some of the traffic from LTE access to WLAN access). Gundavelli, et al. Expires April 24, 2013 [Page 4] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 NAT (Network Address Translation) Network Address Translation [RFC2663] is a method by which IP addresses are mapped from one address realm to another, providing transparent routing to end hosts. 3. Solution Overview The following illustrates the scenario where the mobile access gateway in an access network has enabled IPv4 traffic offload support for a mobility session. The offload decision is based on the IPv4 traffic offload policy that it received from the local mobility anchor in the home network. For example, all the HTTP flows may be offloaded at the mobile access gateway and all the other flows for that mobility session are tunneled back to the local mobility anchor. The offloaded flows have to be typically NAT translated and this specification does not impose any restrictions on the location of the NAT function. It is possible, the NAT function is co-located with the mobile access gateway, or its located some where in the edge of the access network. When the NAT is not collocated on the mobile access gateway, the NAT function should have the ability to identify the offloaded IP traffic for NAT policy enforcement. This could be achieved by configuring a specific VLAN between the mobile access gateway and the NAT device and ensuring all the traffic on that VLAN is NAT translated. This can also be achieved through other means and the details are outside the scope of this document. It is also to be noted that the NAT translation is not required if the offloaded IPv4 flows are for local service access. The IPv4 traffic selectors that are delivered to the mobile access gateway can be used to classify the traffic, so it can be offloaded to the access network. The parameters in the IP traffic selectors can be used to match against the header fields in the data packets. These parameters include Source IP address, Destination IP address, TCP/UDP Port numbers, and other fields. The format of the IPv4 Binary Traffic Selector is specified in section 3.1 of [RFC6088]. Gundavelli, et al. Expires April 24, 2013 [Page 5] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 _----_ _( )_ ( Internet ) (_ _) '----' | : (IPv4 Traffic Offload Point) : | ......................................................... | | +--------+ | +---------------------+ | Local | | | Services requiring | |Services| | | mobility, or service| +--------+ | | treatment | | | +---------------------+ | +---+ | | |NAT| | | +---+ | +-----| _----_ | +-----+ _( )_ +-----+ [MN]----| MAG |======( IP )======| LMA |-- Internet +-----+ (_ _) +-----+ '----' . . [Access Network] . [Home Network] .......................................................... Figure 1: IPv4 Traffic Offload Support at the MAG Figure 2 explains the operational sequence of the Proxy Mobile IPv6 protocol signaling message exchange between the mobile access gateway and the local mobility anchor for negotiating the IPv4 Traffic Offload selectors. The details related to DHCP transactions, or Router Advertisements on the access link are not shown here as that is not the key focus of this specification. Gundavelli, et al. Expires April 24, 2013 [Page 6] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 MN MAG(NAT) LMA |------>| | 1. Mobile Node Attach | |------->| 2. Proxy Binding Update (IPv4TS) | |<-------| 3. Proxy Binding Acknowledgement (IPv4TS) | |========| 4. Tunnel/Route Setup | + | 5. Installing the traffic offload rules |------>| | 6. IPv4 packet from mobile node | + | 7. Forwarding rule - Tunnel home/offload | | | Figure 2: Exchange of IPv4 Traffic Offload Selectors 3.1. LMA Considerations The following considerations apply to the local mobility anchor. o If the configuration variable, EnableIPTrafficOffloadSupport (Section 6) on the local mobility anchor is set to a value of (0), then the local mobility anchor MUST NOT include the IPv4 Traffic Offload Selector option (Section 4) in the Proxy Binding Acknowledgement message. It MUST ignore any IPv4 Traffic Offload Selector option present in the received Proxy Binding Update and process the rest of the message as per [RFC5213]. This would have no effect on the operation of the rest of the protocol. o If the received Proxy Binding Update includes the IPv4 Traffic Offload Selector option (Section 4), and if the configuration variable, EnableIPTrafficOffloadSupport (Section 6) on the local mobility anchor is set to a value of (1), then the local mobility anchor can acquire the offload policy from a network function (Ex: AAA, or PCRF (Policy Charging and Rules Function)) and can construct the traffic selectors based on the offload policy and deliver that traffic offload policy in the Proxy Binding Acknowledgement message using the IPv4 Traffic Offload Selector option. The specific details on how the offload policy for a mobile node is provisioned on the local mobility anchor is out of the scope for this document. However, if the received Proxy Binding Update included a proposed Offload traffic policy, the local mobility anchor MAY choose to honor that request and reflect the proposed selectors in the reply. o If the received Proxy Binding Update does not include the IPv4 Traffic Offload Selector option (Section 4), and if the configuration variable, EnableIPTrafficOffloadSupport (Section 6) on the local mobility anchor is set to a value of (1), then the local mobility anchor SHOULD NOT include the IP Traffic Offload Selector option in the Proxy Binding Acknowledgement. Gundavelli, et al. Expires April 24, 2013 [Page 7] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 3.2. MAG Considerations o If the configuration variable, EnableIPTrafficOffloadSupport on the mobile access gateway is set to a value of (0), then the mobile access gateway MUST NOT include the IPv4 Traffic Offload Selector option (Section 4) in the Proxy Binding Update message that it sends to the local mobility anchor. o If the configuration variable, EnableIPTrafficOffloadSupport on the mobile access gateway is set to a value of (1), then the mobile access gateway MUST include the IPv4 Traffic Offload Selector option (Section 4) in the Proxy Binding Update message. The following considerations apply with respect to including the Traffic Selector Sub-option in the IPv4 Traffic Offload Selector option. * The mobile access gateway MAY choose not to propose any specific IPv4 traffic offload policy. In that scenario, there MUST NOT be any Traffic Selector sub-option in the IPv4 Traffic Offload Selector option. Including the IPv4 Traffic Offload Selector option in the Proxy Binding Update, but without the Traffic Selector Sub-option serves as an indication that the mobile access gateway is not proposing any specific offload policy for that mobility session, but a request to the local mobility anchor to provide the IPv4 traffic offload flow selectors for that mobility session. The (M) flag in the option MUST be set to value of (0). * The mobile access gateway MAY choose to include its proposed IPv4 traffic offload policy. This policy may be locally configured at the mobile access gateway, or may have been obtained from the AAA. In that scenario, the Traffic Selector sub-option MUST be present in the IPv4 Traffic Offload Selector option (Section 4). Including the offload traffic selector sub-option serves as a proposal to the local mobility anchor, which the local mobility anchor can override with its own offload policy, or agree to the proposed policy. When including the offload traffic selectors, the Traffic Selector sub-option MUST be constructed as specified section 4.2.1.4 of [RFC6089]. This sub-option includes a Traffic Selector Format field, which identifies the format of the flow specification included in that sub-option. The values for that field and the corresponding message format are defined in section 3.0 of [RFC6088] o If there is no IPv4 Traffic Offload Selector option in the corresponding Proxy Binding Acknowledgement message, that the mobile access gateway receives in response to a Proxy Binding Gundavelli, et al. Expires April 24, 2013 [Page 8] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 Update, it serves as an indication that the local mobility anchor did not enable IPv4 Traffic Offload support for that mobility session, and hence the local mobility anchor did not deliver IPv4 flow selectors for that mobility session. The mobile access gateway upon accepting the Proxy Binding Acknowledgement message MUST NOT enable any IPv4 traffic offload support for that mobility session. All the mobile node's IPv4 flows MUST be tunneled back to the local mobility anchor. o If there is an IPv4 Traffic Offload Selector option in the corresponding Proxy Binding Acknowledgement message, the mobile access gateway SHOULD enable the IPv4 traffic offload support for that mobility session. It MUST process the Traffic Selector Sub- option for the flow selectors. * If the (M) flag of the IPv4 Traffic Offload Selector option in the received Proxy Binding Acknowledgement is set to a value (0), then the mobile access gateway SHOULD offload all the mobile node's IPv4 flows identified using the flow selectors present in the Traffic Selector Sub-option. The mobile access gateway SHOULD tunnel all other mobile node's IPv4 flows to the local mobility anchor. * If the (M) flag of the IPv4 Traffic Offload Selector option in the received Proxy Binding Acknowledgement is set to a value (1), then the mobile access gateway SHOULD offload all the mobile node's IPv4 flows, except the IPv4 flows identified using the flow selectors present in the Traffic Selector Sub- option. o If configuration variable, EnableIPTrafficOffloadSupport is set to a value of (0), and if the mobile access gateway has not included the IPv4 Traffic Offload Selector option in the Proxy Binding Update, but if the received Proxy Binding Acknowledgement message has the IPv4 Traffic Offload Selector option, then the mobile access gateway SHOULD ignore the option and process the rest of the message as per [RFC5213]. 4. IPv4 Traffic Offload Selector Option A new mobility option, IPv4 Traffic Offload Selector option, is defined for using it in Proxy Binding Update (PBU) and Proxy Binding Acknowledgement (PBA) messages exchanged between a mobile access gateway and a local mobility anchor. This option is used for carrying the IPv4 traffic offload policy. This policy identifies the IPv4 traffic flow selectors that can be used by the IPv4 traffic offload function at the mobile access gateway. Gundavelli, et al. Expires April 24, 2013 [Page 9] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 The alignment requirement for this option is 4n. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |M| Reserved | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Traffic Selector Sub-option ... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 3: IPv4 Traffic Offload Selector Option Type Length 8-bit unsigned integer indicating the length in octets of the option, excluding the type and length fields. Reserved This field is unused for now. The value MUST be initialized to 0 by the sender and MUST be ignored by the receiver. Offload Mode Flag This field indicates the offload mode. If the (M) flag value is set to a value of (0), it is an indication that the identified IPv4 flow(s) in this mobility option SHOULD be offloaded at the mobile access gateway and all other IPv4 flows associated with that mobility session need to be tunneled to the local mobility anchor. If the (M) flag value is set to a value of (1), it is an indication that all the IPv4 flows associated to that mobility session except the identified IPv4 flow(s) in the Traffic Selector sub-option that follows SHOULD be offloaded at the mobile access gateway. Traffic Selector Sub-option The traffic selector sub-option includes the parameters used to match packets for a specific flow binding. This is an optional field when this option is used only a capability hint. The format of the Traffic Selector sub-option is defined in section 4.2.1.4 of [RFC6089]. This sub-option includes a TS Format field, which Gundavelli, et al. Expires April 24, 2013 [Page 10] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 identifies the format of the flow specification included in that sub-option. The values for that field are defined in section 3 of [RFC6089] and are repeated here for completeness. When the value of TS Format field is set to (1), the format that follows is the IPv4 Binary Traffic Selector specified in section 3.1 of [RFC6088] and that support is mandatory for this specification. 1: IPv4 binary traffic selector. 2: IPv6 binary traffic selector (Not used by this specification) 5. IANA Considerations This document requires the following IANA action. o Action-1: This specification defines a new mobility header option, IPv4 Traffic Offload Selector option. This option is described in Section 4. The Type value for this option needs to be assigned from the same numbering space as allocated for the other mobility options [RFC6275]. 6. Protocol Configuration Variables This specification defines the following configuration variable that control the IPv4 Traffic Offload support feature. The mobility entities, local mobility anchor and the mobile access gateway MUST allow these variables to be configured by the system management. The configured values for these protocol variables MUST survive server reboots and service restarts. EnableIPTrafficOffloadSupport This flag indicates whether or not IPv4 Traffic Offload support needs to be enabled. This configuration variable is available at both in the mobile access gateway and at the local mobility anchor. The default value for this flag is set to (0), indicating that the support for IPv4 Traffic offload support is disabled. When this flag on the mobile access gateway is set to a value of (1), the mobile access gateway MUST enable the IPv4 Traffic offload support for all mobility sessions, specifically it MUST request the IPv4 traffic offload policy from the local mobility anchor by including the IPv4 Traffic Offload Selector option in the Proxy Binding Update message. If the flag is set to a Gundavelli, et al. Expires April 24, 2013 [Page 11] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 value of (0), the mobile access gateway MUST NOT enable IPv4 Traffic Offload support for any mobility session. It MUST NOT include the IPv4 Traffic Offload Selector option in the Proxy Binding Update. Similarly, when this flag on the local mobility anchor is set to a value of (1), the local mobility anchor MUST enable support for IPv4 Traffic offload support. When the local mobility anchor chooses to enable IPv4 Traffic offload support and if there is offload flow policy specified for a mobile node, it SHOULD deliver the IPv4 traffic offload policy to the mobile access gateway by including the IPv4 Traffic Offload Selector option in the Proxy Binding Acknowledgement message. 7. Security Considerations The IPv4 Traffic Offload Selector option defined in this specification is for use in Proxy Binding Update and Proxy Binding Acknowledgement messages. This option is carried like any other mobility header option as specified in [RFC5213] and does not require any special security considerations. Carrying IPv4 traffic offload selectors does not introduce any new security vulnerabilities. When IPv4 traffic offload support is enabled for a mobile node, the mobile access gateway selectively offloads some of the mobile node's IPv4 traffic flows to the access network. Typically, these offloaded flows get NAT translated and essentially that introduces certain vulnerabilities which are common to any NAT deployment. These vulnerabilities and the related considerations have been well documented in the NAT specification [RFC2663]. There are no additional considerations above and beyond what has already been documented by the NAT specifications and which are unique to the approach specified in this document. 8. Acknowledgements The authors would like to thank Ahmad Muhanna, Basavaraj Patil, Carlos Bernardos, Eric Voit, Frank Brockners, Hidetoshi Yokota, Marco Liebsch, Mark Grayson, Pierrick Seite, Ryuji Wakikawa, Steve Wood and Brian Haberman for all the discussions related to the topic of IPv4 traffic offload. 9. References Gundavelli, et al. Expires April 24, 2013 [Page 12] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 9.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC5213] Gundavelli, S., Leung, K., Devarapalli, V., Chowdhury, K., and B. Patil, "Proxy Mobile IPv6", RFC 5213, August 2008. [RFC5844] Wakikawa, R. and S. Gundavelli, "IPv4 Support for Proxy Mobile IPv6", RFC 5844, May 2010. [RFC6088] Tsirtsis, G., Giarreta, G., Soliman, H., and N. Montavont, "Traffic Selectors for Flow Bindings", RFC 6088, January 2011. [RFC6089] Tsirtsis, G., Soliman, H., Montavont, N., Giaretta, G., and K. Kuladinithi, "Flow Bindings in Mobile IPv6 and Network Mobility (NEMO) Basic Support", RFC 6089, January 2011. [RFC6275] Perkins, C., Johnson, D., and J. Arkko, "Mobility Support in IPv6", RFC 6275, July 2011. 9.2. Informative References [RFC2663] Srisuresh, P. and M. Holdrege, "IP Network Address Translator (NAT) Terminology and Considerations", RFC 2663, August 1999. [TS23402] 3GPP, "Architecture enhancements for non-3GPP accesses", 2010. Authors' Addresses Sri Gundavelli (editor) Cisco 170 West Tasman Drive San Jose, CA 95134 USA Email: sgundave@cisco.com Gundavelli, et al. Expires April 24, 2013 [Page 13] Internet-Draft IPv4 Traffic Offload Selector Option October 2012 Xingyue Zhou ZTE Corporation No.68 Zijinghua Rd Nanjing China Email: zhou.xingyue@zte.com.cn Jouni Korhonen Nokia Siemens Networks Linnoitustie 6 Espoo FIN-02600 Finland Email: jouni.nospam@gmail.com Gaetan Cisco France Email: gfeige@cisco.com Rajeev Koodli Cisco 3650 Cisco Way San Jose, CA 95134 USA Email: rkoodli@cisco.com Gundavelli, et al. Expires April 24, 2013 [Page 14]