| RFC 8818 | Distributed Mobility Anchoring | October 2020 |
| Chan, et al. | Informational | [Page] |
This document defines distributed mobility anchoring in terms of the differentconfigurations and functions to provide IP mobility support. A network may beconfigured with distributed mobility anchoring functions for both network-basedor host-based mobility support, depending on the network's needs. In adistributed mobility anchoring environment, multiple anchors are available formid-session switching of an IP prefix anchor. To start a new flow or to handle aflow not requiring IP session continuity as a mobile node moves to a newnetwork, the flow can be started or restarted using an IP address configuredfrom the new IP prefix anchored to the new network. If the flow needs to survivethe change of network, there are solutions that can be used to enable IP addressmobility. This document describes different anchoring approaches, depending onthe IP mobility needs, and how this IP address mobility is handled by thenetwork.¶
This document is not an Internet Standards Track specification; it is published for informational purposes.¶
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are candidates for any level of Internet Standard; see Section 2 of RFC 7841.¶
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained athttps://www.rfc-editor.org/info/rfc8818.¶
Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶
A key requirement in distributed mobility management (DMM)[RFC7333] isto enable traffic to avoid traversing a single mobility anchor far from anoptimal route. This document defines different configurations, functionaloperations, and parameters for distributed mobility anchoring and explains how touse them to avoid unnecessarily long routes when a mobile node moves.¶
Other distributed mobility management documents already addresssource address selection[RFC8653] andcontrol-plane and data-plane signaling[FPC-DMM-PROTOCOL]. Anumber of distributed mobility solutions have also been proposed, for example,in[DMM-DMA],[RFC8885],[DMM-WIFI],[DMM-ENHANCED-ANCHORING], and[STATELESS-UPLANE-VEPC].¶
Distributed mobility anchoring employs multiple anchors in the data plane. Ingeneral, control-plane functions may be separated from data-plane functions andbe centralized but may also be co-located with the data-plane functions at thedistributed anchors. Different configurations of distributed mobility anchoringare described inSection 3.1.¶
As a Mobile Node (MN) attaches to an access router and establishes a linkbetween them, a /64 IPv6 prefix anchored to the router may be assigned to thelink for exclusive use by the MN[RFC6459]. The MN may thenconfigure a global IPv6 address from this prefix and use it as the source IPaddress in a flow to communicate with its Correspondent Node (CN). When thereare multiple mobility anchors assigned to the same MN, an address selection fora given flow is first required before the flow is initiated. Using an anchor inan MN's network of attachment has the advantage that the packets can simply beforwarded according to the forwarding table. However, after the flow has beeninitiated, the MN may later move to another network that assigns a new mobilityanchor to the MN. Since the new anchor is located in a different network, theMN's assigned prefix does not belong to the network where the MN is currentlyattached.¶
When the MN wants to continue using its assigned prefix to complete ongoing datasessions after it has moved to a new network, the network needs to providesupport for the MN's IP address and session continuity, since routing packetsto the MN through the new network deviates from applying default routes. The IPsession continuity needs of a flow (application) determine how the IP addressused by this flow has to be anchored. If the ongoing IP flow can cope with an IPprefix/address change, the flow can be reinitiated with a new IP addressanchored in the new network. On the other hand, if the ongoing IP flow cannotcope with such change, mobility support is needed. A network supporting a mix offlows both requiring and not requiring IP mobility support will need todistinguish these flows.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14[RFC2119][RFC8174] when, and only when, they appear in all capitals, as shown here.¶
All general mobility-related terms and their acronyms used in this documentare to be interpreted as defined in the Mobile IPv6 (MIPv6) base specification[RFC6275], the Proxy Mobile IPv6 (PMIPv6)specification[RFC5213], the MobilityTerminology document[RFC3753], and the DMMCurrent Practices and Gap Analysis document[RFC7429].These include terms such as Mobile Node (MN), Correspondent Node (CN), HomeAgent (HA), Home Address (HoA), Care-of-Address (CoA), Local Mobility Anchor(LMA), and Mobile Access Gateway (MAG).¶
In addition, this document uses the following terms and definitions:¶
The ability to maintain an ongoing transport interaction by keeping the samelocal endpoint IP address throughout the lifetime of the IP socket despite themobile host changing its point of attachment within the IP network topology. TheIP address of the host may change after closing the IP socket and before openinga new one, but that does not jeopardize the ability of applications using theseIP sockets to work flawlessly. Session continuity is essential for mobile hoststo maintain ongoing flows without any interruption[RFC8653].¶
The ability to maintain an ongoing transport- or higher-layer (e.g., application)interaction by keeping the session identifiers throughout the lifetime of thesession despite the mobile host changing its point of attachment within the IPnetwork topology. This can be achieved by using mechanisms at the transport orhigher layers.¶
The ability to maintain the same IP address for an extended period of time. TheIP address stays the same across independent sessions, even in the absence ofany session. The IP address may be published in a long-term registry (e.g., DNS)and is made available for serving incoming (e.g., TCP) connections. IP addressreachability is essential for mobile hosts to use specific/published IPaddresses[RFC8653].¶
The combination of IP address reachability and session continuity.¶
An IP prefix (i.e., Home Network Prefix (HNP)) or address (i.e., HoA) assignedfor use by an MN is topologically anchored to an anchor node when the anchornode is able to advertise a route into the routing infrastructure for theassigned IP prefix. The traffic using the assigned IP address/prefix musttraverse the anchor node. We can refer to the function performed by the IP anchornode as anchoring, which is a data-plane function.¶
A control-plane function that keeps and manages the network location informationof an MN. The location information may be a binding of the advertised IPaddress/prefix (e.g., HoA or HNP) to the IP routing address of the MN or of anode that can forward packets destined to the MN.¶
When the MN is a Mobile Router (MR), the location information will also includethe Mobile Network Prefix (MNP), which is the aggregate IP prefix delegated tothe MR to assign IP prefixes for use by the Mobile Network Nodes (MNNs) in themobile network.¶
In a client-server protocol model, secure (i.e., authenticated and authorized) location query and update messages may beexchanged between a Location Management client (LMc) and a Location Managementserver (LMs), where the location information can be updated or queried fromthe LMc.Optionally, there may be a Location Management proxy (LMp) between LMc and LMs.¶
With separation of control plane and data plane, the LM function is in thecontrol plane. It may be a logical function at the control-plane node, control-plane anchor, or mobility controller.¶
It may be distributed or centralized.¶
Packet interception and forwarding to/from the IP address/prefix assigned for use by the MN, based on the internetwork location information, either to the destination or to some other network element that knows how to forward the packets to their destination.¶
This function may be used to achieve traffic indirection. With separation of control plane and data plane, the FM function may split into an FM function in the data plane (FM-DP) and an FM function in the control plane (FM-CP).¶
FM-DP may be distributed with distributed mobility management. It may be a function in a data-plane anchor or data-plane node.¶
FM-CP may be distributed or centralized. It may be a function in a control-plane node,control-plane anchor, or mobility controller.¶
The Home-CPA function hosts the MN's mobilitysession. There can be more than one mobility session for a mobilenode, and those sessions may be anchored on the same or differentHome-CPA's. The Home-CPA will interface with the Home-DPA formanaging the forwarding state.¶
The Home-DPA is the topological anchor for the MN's IP address/prefix(es).The Home-DPA is chosen by the Home-CPA on a session basis. The Home-DPA isin the forwarding path for all the mobile node's IP traffic.¶
The Access-CPN is responsible for interfacing with the mobilenode's Home-CPA and with the Access-DPN. The Access-CPN has aprotocol interface to the Home-CPA.¶
The Access-DPN function is hosted on the first-hop router wherethe mobile node is attached. This function is not hosted on aLayer 2 bridging device such as an eNode(B) or Access Point.¶
We next describe some configurations with multiple distributed anchors. Tocover the widest possible spectrum of scenarios, we consider architectures inwhich the control and data planes are separated. We analyze where LM and FMfunctions, which are specific sub-functions involved in mobility management,can be placed when looking at the different scenarios with distributedanchors.¶
Figure 1 shows a general scenario for network-baseddistributed mobility management.¶
The main characteristics of a network-based DMM solution are:¶
____________ Network ___/ \___________ / +-----+ \___ ( |LMs | Control- \ / +-.---+ plane \ / +--------.---+ functions \ ( |CPA: . | in the ) ( |FM-CP, LMc | network ) ( +------------+ \ / . . \( . . )( . . )( . . \ \ +------------+ +------------+Distributed ) ( |DPA(IPa1): | |DPA(IPa2): |DPAs ) ( |anchors IP1 | |anchors IP2 | _/ \ |FM-DP | |FM-DP | etc. / \ +------------+ +------------+ / \___ Data-plane _____/ \______ functions / \__________________/ +------------+ |MN(IP1) | Mobile node attached |flow(IP1,..)| to the network +------------+
Figure 2 shows a general scenario for client-baseddistributed mobility management. In this configuration, the mobile node performsControl-Plane Node (CPN) and Data-Plane Node (DPN) mobility functions, namelythe forwarding management and location management (client) roles.¶
+-----+ |LMs | +-.---++--------.---+|CPA: . ||FM-CP, LMp |+------------+ . . . . . . . .+------------+ +------------+ Distributed|DPA(IPa1): | |DPA(IPa2): | DPAs|anchors IP1 | |anchors IP2 ||FM-DP | |FM-DP | etc.+------------+ +------------++------------+|MN(IP1) |Mobile node|flow(IP1,..)|using IP1|FM, LMc |anchored to+------------+DPA(IPa1)
IP mobility support may be provided only when needed instead of being providedby default. Three cases can be considered:¶
A straightforward choice of mobility anchoring is the following: the MNchooses, as a source IP address for packets belonging to an IP flow, anaddress allocated by the network the MN is attached to when the flow wasinitiated.As such, traffic belonging to this flow traverses the MN's mobility anchor[DMM-DMA][RFC8885].¶
The IP prefix/address at the MN's side of a flow may be anchored to the AccessRouter (AR) to which the MN is attached. For example, when an MN attaches to anetwork (Net1) or moves to a new network (Net2), an IP prefix from the attachednetwork is assigned to the MN's interface. In addition to configuring newlink-local addresses, the MN configures from this prefix an IP address that istypically a dynamic IP address (meaning that this address is only used while theMN is attached to this access router, so the IP address configured bythe MN dynamically changes when attaching to a different access network). Itthen uses this IP address when a flow is initiated. Packets from this flowaddressed to the MN are simply forwarded according to the forwarding table.¶
There may be multiple IP prefixes/addresses that an MN can select wheninitiating a flow. They may be from the same access network or differentaccess networks. The network may advertise these prefixes with cost options[PREFIX-COST] so that the mobilenode may choose the one with the least cost. In addition, the IPprefixes/addresses provided by the network may be of different types regardingwhether mobility support is supported[RFC8653]. An MN will need to choose which IP prefix/address to usefor each flow according to whether or not it needs IP mobility support, for example, using the mechanisms described in[RFC8653].¶
When IP mobility support is not needed for a flow, the LM and FM functions arenot utilized so that the configurations inSection 3.1 are simplified as shown inFigure 3.¶
Net1 Net2+---------------+ +---------------+|AR1 | AR is changed |AR2 |+---------------+ -------> +---------------+|CPA: | |CPA: ||---------------| |---------------||DPA(IPa1): | |DPA(IPa2): ||anchors IP1 | |anchors IP2 |+---------------+ +---------------++...............+ +---------------+.MN(IP1) . MN moves |MN(IP2) |.flow(IP1,...) . =======> |flow(IP2,...) |+...............+ +---------------+
When there is no need to provide IP mobility to a flow, the flow may use a newIP address acquired from a new network as the MN moves to the new network.¶
Regardless of whether or not IP mobility is needed, if the flow has not terminated beforethe MN moves to a new network, the flow may subsequently restart using the newIP address assigned from the new network.¶
When IP session continuity is needed, even if an application flow is ongoing asthe MN moves, it may still be desirable for the application flow to change tousing the new IP prefix configured in the new network. The application flow maythen be closed at the IP level and then be restarted using a new IP addressconfigured in the new network. Such a change in the IP address used by theapplication flow may be enabled using a higher-layer mobility support that isnot in the scope of this document.¶
InFigure 3, a flow initiated while the MN was using theIP prefix IP1, anchored to a previous access router AR1 in network Net1, hasterminated before the MN moves to a new network Net2. After moving to Net2, theMN uses the new IP prefix IP2, anchored to a new access router AR2 in networkNet2, to start a new flow. Packets may then be forwarded without requiring IP-layer mobility support.¶
An example call flow is outlined inFigure 4. An MN attaches to AR1, which sends a router advertisement(RA) including information about the prefix assigned to the MN, from which theMN configures an IP address (IP1). This address is used for newcommunications, for example, with a correspondent node (CN). If the MN moves toa new network and attaches to AR2, the process is repeated (the MN obtains a newIP address, IP2, from AR2). Since the IP address (IP1) configured at thepreviously visited network is not valid at the current attachment point,any existing flows have to be reestablished using IP2.¶
Note that in these scenarios, if there is no mobility support provided byLayer 4 orabove, application traffic would stop.¶
MN AR1 AR2 CN |MN attaches to AR1: | | | |acquires MN-ID and profile | | |--RS---------------->| | | | | | | |<----------RA(IP1)---| | | | | | |Assigned prefix IP1 | | |IP1 address configuration | | | | | | |<-Flow(IP1,IPcn,...)-+------------------------------------------>| | | | | |MN detaches from AR1 | | | |MN attaches to AR2 | | | | | | | |--RS------------------------------>| | | | | | |<--------------RA(IP2)-------------| | | | | |Assigned prefix IP2 | | |IP2 address configuration | | | | | | |<-new Flow(IP2,IPcn,...)-----------+---------------------------->| | | | |
When IP mobility is needed for a flow, the LM and FM functions inSection 3.1 are utilized. There are twopossible cases: (i) the mobility anchor remains playing that role and forwards traffic to a new locator in the new network, and (ii) the mobility anchor (data-planefunction) is changed but binds the MN's transferred IP address/prefix. The latter enables optimized routes but requires some data-plane node thatenforces traffic indirection. We focus on the first case in this section. Thesecond case is addressed inSection 4.3.¶
Mobility support can be provided by using mobility management methods, such asthe approaches surveyed in the following academic papers:[IEEE-DISTRIBUTED-MOBILITY],[PMIP-DMA], and[DMM-MOBILE-INTERNET]. After moving, a certain MN's traffic flow may continueusing the IP prefix from the prior network of attachment. Yet, some timelater, the application generating this traffic flow may be closed. If theapplication is started again, the new flow may not need to use the priornetwork's IP address to avoid having to invoke IP mobility support. This maybe the case where a dynamic IP prefix/address, rather than a permanent one, isused. Packets belonging to this flow may then use the new IP prefix (the oneallocated in the network where the flow is being initiated). Routing is againkept simpler without employing IP mobility and will remain so as long as theMN, which is now in the new network, does not move again to another network.¶
An example call flow in this case is outlined inFigure 5. In this example, the AR1plays the role of the FM-DP entity and redirects the traffic (e.g., using an IPtunnel) to AR2.¶
MN AR1 AR2 CN |MN attaches to AR1: | | | |acquires MN-ID and profile | | |--RS---------------->| | | | | | | |<----------RA(IP1)---| | | | | | |Assigned prefix IP1 | | |IP1 address configuration | | | | | | |<-Flow(IP1,IPcn,...)-+------------------------------------------>| | | | | |MN detaches from AR1 | | | |MN attaches to AR2 | | | | | | | |--RS------------------------------>| | (some IP mobility support solution) |<--------------RA(IP2,IP1)---------| | | | | | | +<-Flow(IP1,IPcn,...)---------------------->| | +<===========>+ | |<-Flow(IP1,IPcn,...)-------------->+ | | | | |Assigned prefix IP2 | | |IP2 address configuration | | | | | |Flow(IP1,IPcn) terminates | | | | | | |<-new Flow(IP2,IPcn,...)-----------+---------------------------->| | | | |
Another solution could be to place an FM-DP entity closer tothe CN network to perform traffic steering to deviate from default routes(which will bring the packet to AR1 per default routing). The LM and FMfunctions are implemented as shown inFigure 6.¶
Net1 Net2+---------------+ +---------------+|AR1 | |AR2 |+---------------+ +---------------+|CPA: | |CPA: || | |LM:IP1 at IPa1 ||---------------| IP1 (anchored to Net1) |---------------||DPA(IPa1): | is redirected to Net2 |DPA(IPa2): ||anchors IP1 | =======> |anchors IP2 ||FM:IP1 via IPa2| |FM:IP1 via IPa1|+---------------+ +---------------++...............+ +---------------+.MN(IP1) . MN moves |MN(IP2,IP1) |.flow(IP1,...) . =======> |flow(IP1,...) |. . |flow(IP2,...) |+...............+ +---------------+
Multiple instances of DPAs (at access routers), which are providing IP prefixesto the MNs, are needed to provide distributed mobility anchoring in anappropriate configuration such as those described inFigure 1 (Section 3.1.1) for network-baseddistributed mobility or inFigure 2 (Section 3.1.2) for client-based distributedmobility.¶
We focus next on the case where the mobility anchor (data-plane function) ischanged but binds the MN's transferred IP address/prefix. This enables optimizedroutes but requires some data-plane node that enforces traffic indirection.¶
IP mobility is invoked to enable IP session continuity for an ongoing flow asthe MN moves to a new network. The anchoring of the IP address of the flow is inthe home network of the flow (i.e., different from the current network ofattachment). A centralized mobility management mechanism may employ indirectionfrom the anchor in the home network to the current network of attachment. Yet, itmay be difficult to avoid using an unnecessarily long route (when the routebetween the MN and the CN via the anchor in the home network is significantlylonger than the direct route between them). An alternative is to move the IPprefix/address anchoring to the new network.¶
The IP prefix/address anchoring may move without changing the IP prefix/address of the flow.The LM function inFigure 1 ofSection 3.1.1is implemented as shown inFigure 7.¶
Net1 Net2+---------------+ +---------------+|AR1 | |AR2 |+---------------+ +---------------+|CPA: | |CPA: ||LM:IP1 at IPa1 | |LM:IP1 at IPa2 || changes to | | || IP1 at IPa2 | | ||---------------| |---------------||DPA(IPa1): | IP1 anchoring effectively moved |DPA(IPa2): ||anchored IP1 | =======> |anchors IP2,IP1|+---------------+ +---------------++...............+ +---------------+.MN(IP1) . MN moves |MN(IP2,IP1) |.flow(IP1,...) . =======> |flow(IP1,...) |+...............+ +---------------+
As an MN with an ongoing session moves to a new network, the flow may preserveIP session continuity by moving the anchoring of the original IP prefix/addressof the flow to the new network.¶
One way to accomplish such a move is to use a centralized routing protocol,but such a solution may present some scalability concerns and itsapplicability is typically limited to small networks. One example of this typeof solution is described in[BGP-ATN-IPS]. When an MN associates with an anchor, the anchor injects the MN's prefix intothe global routing system. If the MN moves to a new anchor, the old anchorwithdraws the /64 and the new anchor injects it instead.¶
As stated in[RFC7333], "a DMM solutionMUST support any securityprotocols and mechanisms needed to secure the network and to make continuoussecurity improvements". It "MUST NOT introduce new security risks".¶
There are different potential deployment models of a DMM solution. The presentdocument has presented three different scenarios for distributed anchoring:(i) nomadic case, (ii) mobility case with traffic redirection, and (iii)mobility case with anchor relocation. Each of these cases has different securityrequirements, and the actual security mechanisms depend on the specificsof each solution/scenario.¶
As general rules, for the first distributed anchoring scenario (nomadic case),no additional security consideration is needed, as this does not involve anyadditional mechanism at Layer 3. If session connectivity is required, theLayer 4 orabove solution used to provide itMUST also provide therequired authentication and security.¶
The second and third distributed anchoring scenarios (mobility case) involvemobility signaling among the mobile node and the control-plane and data-planeanchors. The control-plane messages exchanged between these entitiesMUST be protected using end-to-end security associations withdata-integrity and data-origination capabilities. IPsec[RFC8221] Encapsulating Security Payload (ESP) in transport mode withmandatory integrity protectionSHOULD be used for protectingthe signaling messages. Internet Key Exchange Protocol Version 2 (IKEv2)[RFC8247]SHOULD be used to set up security associations between the data-planeand control-plane anchors. Note that in scenarios in which traffic indirectionmechanisms are used to relocate an anchor, authentication and authorizationmechanismsMUST be used.¶
Control-plane functionalityMUST apply authorization checks to any commands orupdates that are made by the control-plane protocol.¶
This document has no IANA actions.¶
The work ofJong-Hyouk Lee was supported by the MSIT (Ministry of Scienceand ICT), Korea, under the ITRC (Information Technology Research Center)support program (IITP-2020-2015-0-00403) supervised by the IITP (Institute forInformation & communications Technology Planning & Evaluation).¶
Alexandre Petrescu andFred Templin had contributed to earlier draft versions of this document regardingdistributed anchoring for hierarchical networks and for network mobility,although these extensions were removed to keep the document within reasonablelength.¶
This document has benefited from other work on mobility support in SDN networks,on providing mobility support only when needed, and on mobility support inenterprise networks. These works have been referenced. While some of theseauthors have taken the work to jointly write this document, others havecontributed at least indirectly by writing these works. The latter includePhilippe Bertin,Dapeng Liu,Satoru Matushima,Pierrick Seite,Jouni Korhonen,andSri Gundavelli.¶
For completeness, some terminology from draft-ietf-dmm-deployment-models-04has been incorporated into this document.¶
Valuable comments have been received fromJohn Kaippallimalil,ChunShan Xiong,Dapeng Liu,Fred Templin,Paul Kyzivat,Joseph Salowey,Yoshifumi Nishida,Carlos Pignataro,Mirja Kuehlewind,Eric Vyncke,Qin Wu,Warren Kumari,Benjamin Kaduk,Roman Danyliw, andBarry Leiba.Dirk von Hugo,Byju Pularikkal, andPierrick Seite havegenerously provided careful review with helpful corrections andsuggestions.Marco Liebsch andLyle Bertz also performed very detailed and helpful reviews of this document.¶