E-Library_NIST.SP.500-267A_R1.pdf.pdf

NIST Special Publication 500-267A

Revision 1

NIST IPv6 Profile

Doug Montgomery

Mark Carson

Timothy Winters

Michayla Newcombe

Timothy Carlin

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.500-267Ar1

Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and

Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This document reports on

ITL’s research, guidance, and outreach efforts in Information Technology and its collaborative activities with industry, government, and academic organizations.

DISCLAIMER

This document has been prepared by the National Institute of Standards and Technology

(NIST) and describes standards research in support of NIST’s Trustworthy Networks

Program. Certain commercial entities, equipment, or material may be identified in this document to describe a concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that these entities, materials, or equipment are necessarily the best available for the purpose.

Nothing in this document is intended to contradict standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority, nor ought this profile to be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the Office of Management and

Budget, or any other Federal official.

National Institute of Standards and Technology Special Publication 500-267Ar1

Natl. Inst. Stand. Technol. Spec. Publ. 500-267Ar1, 81 pages (November 2020)

CODEN: NSPUE2

This publication is available free of charge from:

i

T h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

A r1

Executive Summary

This document defines a profile of Internet Protocol version 6 (IPv6) capabilities for the purpose of expressing technical requirements for networked information technology (IT) products and to report the IPv6 capabilities of specific products. The original design of this profile was developed collaboratively with, and aligned to, industry led product test programs

[IPv6-Ready, NIST-IPv6F] and documented in an acquisition profile for one specific user group [SP500-267].

This new document provides significant revisions to the original IPv6 profile, including:

1. Separating the definition of IPv6 capability profiles from their use in specific acquisition programs to enable other user groups to re-use the capability profiles and their aligned product testing programs.

2. Updating the set of Internet Engineering Task Force (IETF) specifications that form the basis for the profile to their latest published versions. In particular, this revision, adopts the most recent, Internet standard, versions of the base IPv6 specifications.

3. Adding new specifications for important IPv6 capabilities that have been developed since the publication of the first profile.

a. Highlights of these additions include technologies to support emerging use cases such as Internet of Things, and new forms of IPv6 transition technologies that focus on legacy support of IPv4 in IPv6 native networks.

4. Adding the ability to specify requirements for functionality necessary to support

“IPv6-only” environments, and better support for specification and test of IPv6 capable applications.

5. Removing specifications for IPv6 capabilities included in the first version of the profile but that have since failed to achieve significant support in commercial products and network deployments.

An example of one user group’s use of this capability profile in an acquisition program and coordinated product testing program can be found in [SP500-267Br1] and [SP500-281Ar1].

While this capability profile has its origins in that specific user group, it has been refactored to be independent of any specific acquisition program.

This profile is not subject to copyright and its reuse, either in its entirety, or in derivative works, is encouraged.

ii h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Abstract

This profile establishes a basic taxonomy of IPv6 capabilities, defined in terms of IETF specifications, resulting in specific capability labels for common network functions and usage scenarios. The profile maps each such labeled capability to one or more specific technical specifications, or parts of specifications. Each labeled capability adopts by reference the normative requirements of the cited specifications. In rare cases the profile may augment or modify the normative requirements of a base specification. The defined capability labels effectively form a vocabulary for expressing IPv6 requirements for, and documenting the IPv6 capabilities of, specific products. It is expected that, when combined with specific acquisition and product testing programs, this profile can facilitate the efficient adoption of IPv6 technologies in many industry sectors.

Keywords

Internet Protocol version 6; IPv6; standards profile; acquisition; NISTv6; NISTv6-r1.

iii h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Table of Contents

Introduction

1.1. Audience

1.2. Profiling IPv6 Capabilities

1.3. Profile Structure: Functional Roles and Capability Groups

1.4. Profiling Products and Implementations

Profile Scope, Applicability and Conventions

2.1. Scope and Applicability

2.2. Life Cycles and Change Management

2.3. Statements of Requirements Levels

2.4. Profile Capabilities Table

2.5. Capability Summary Strings

2.6. Conformance, Testing and Reporting

Selection of IPv6 Capabilities

3.1. IPv6-Only Capabilities

3.1.1. Selecting IPv6-Only Capabilities

3.2. Host Capabilities

3.2.1. Selecting Host Capabilities

3.3. Router Capabilities

3.3.1. Selecting Router Capabilities

3.4. Network Protection Product Capabilities

3.4.1. Selecting Network Protection Product Capabilities

3.5. Switch Capabilities

3.5.1. Selecting Switch Capabilities

3.6. Application and Services Capabilities

3.6.1. Selecting Application and Services Capabilities

Technical Definition of IPv6 Capabilities

4.1. IPv6-Only Capabilities

4.1.1. Definition of IPv6-only Capability Requirements

4.2. Basic Capabilities

4.2.1. Definition of Basic Capability Requirements

4.3. Routing Capabilities

4.3.1. Definition of Routing Capability Requirements

4.4. Quality of Service Capabilities

4.4.1. Definition of Quality of Service Capability Requirements

4.5. Transition Mechanism Capabilities

4.5.1. Definition of Transition Mechanism Capability Requirements iv h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

4.6. Link Specific Capabilities

4.6.1. Definition of Link Specific Capability Requirements

4.7. Addressing Capabilities

4.7.1. Definition of Addressing Capability Requirements

4.8. Security Capabilities

4.8.1. Definition of Security Capability Requirements

4.9. Network Management Capabilities

4.9.1. Definition of Network Management Capability Requirements

4.10. Multicast Capabilities

4.10.1. Definition of Multicast Capability Requirements

4.11. Network Support Capabilities

4.11.1. Definition of Network Support Capability Requirements

4.12. Application and Service Capabilities

4.12.1. Definition of Application and Service Capability Requirements

4.13. Switch Capabilities

4.13.1. Definition of Switch Capability Requirements

4.14. Network Protection Product Capabilities

4.14.1. Definition of Network Protection Product Capability Requirements

4.14.2. Source of requirements

4.14.3. Common requirements for network protection products

4.14.4. Firewall requirements (Common Requirements)

4.14.5. Application firewall requirements

4.14.6. Intrusion detection and prevention system requirements

4.14.7. Intrusion prevention requirements

Profile Usage Guidance and Examples

Acknowledgments

References

Appendix A: Change Log h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Introduction

This document establishes a profile of Internet Protocol version 6 (IPv6) capabilities for the purpose of expressing technical requirements for networked information technology (IT) products and to report the IPv6 capabilities of specific products. The original design of this profile was developed collaboratively with, and aligned to, industry led product test programs

[IPv6-Ready, NIST-IPv6F] and documented in an acquisition profile for one specific user group [SP500-267].

This new document, provides significant revisions to the original profile, including:

1. Separating the definition of IPv6 capability profiles from their use in specific acquisition programs to enable other user groups to re-use the capability profiles and their aligned product testing programs.

2. Updating the set of Internet Engineering Task Force (IETF) specifications that form the basis for the profile to their latest published versions. In particular, this revision, adopts the most recent, Internet standard, versions of the base IPv6 specifications.

3. Adding new specifications for important IPv6 capabilities that have been developed since the publication of the first profile.

a. Highlights of these additions include technologies to support emerging use cases such as Internet of Things, and new forms of IPv6 transition technologies that focus on legacy support of IPv4 in IPv6 native networks.

4. Adding the ability to specify requirements for functionality necessary to support

“IPv6 Only” environments, and better support for specification and test of IPv6 capable applications.

5. Removing specifications for IPv6 capabilities included in the first version of the profile but that have since failed to achieve significant support in commercial products and network deployments.

An example of one user group’s use of this profile in an acquisition program and coordinated product testing program can be found in [SP500-267Br1] and [SP500-281Ar1]. While this capability profile has its origins in a specific user group, it has been refactored to be independent of any specific acquisition program.

This profile is not subject to copyright and its reuse, either in its entirety, or in derivative works is encouraged. References to this specification should cite:

• “NIST IPv6 Profile”, NIST Special Publication 500-267A revision 1, National

Institute of Standards and Technology, November 2020,

• The abbreviation “NISTv6-r1” is used to identify this profile in various usages.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

1.1. Audience

This document is intended to assist several communities of interest in the planning and implementation of IPv6 acquisition programs. The range of potential uses of this profile include establishing a technical basis for broad IPv6 acquisition strategies, defining requirements for individual procurements or documenting the IPv6 capabilities of individual products.

This profile assumes that the readers have some level of familiarity with IPv6 and with its corpus of specifications (i.e., IETF Request for Comments [RFC]s). Readers are directed to the wealth of books and training materials that provide such introductions to IPv6 technologies.

The main purpose of this document is to identify and organize the vast collection of IPv6 specifications into subsets of labeled capabilities that may be of common utility in planning for and acquiring specific IPv6 products and services. As such, the profile is primarily targeted to users in the following groups:

• Users and Purchasers - Those writing procurement and contract language may use this document as a reference to develop product requirement specifications. For their purposes, this document aims to facilitate the development of precise specifications of

IPv6 technical requirements that must be met by offered products. It should be noted that this profile only addresses IPv6 requirements, and thus cannot stand in isolation as a complete procurement specification. Many other technical issues (e.g., IPv4 capabilities, hardware, performance, reliability, support) and procurement policies must be typically addressed to fully define a complete procurement requirement.

Those developing procurement requirements will be primarily interested in sections

1.4, 2.4 and 3 of this document.

• Developers – Developers of network protocols, applications and services may use this document as reference when they describe the IPv6 capabilities of their products.

In addition, developers of networked IT should view the defined capabilities in this profile as a potential source of technical requirements for future acquisitions and the anticipate the need to demonstrate and document compliance with such requirements.

Developers and vendors will be primarily interested in sections 1.4, 2.4, 2.6 and 4 of this document.

• Testing and Accreditation Organizations – Some user groups may request or require independent testing of networked IT products to demonstrate compliance with requirements defined in this profile. Often such testing programs may require accreditation of testing services. Organizations that support formal testing programs associated with this profile will be primarily interested in sections 2.6 and 4 of this document.

• Other Profile Developers – User groups may choose to develop derivative works based upon this profile, potentially modifying the recommendations, conformance, testing and/or reporting requirements described herein. While such efforts are encouraged when necessary, it is requested that they avoid duplication and adopt unmodified portions of this profile by reference rather than duplication.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

All members of this audience, and others, are encouraged to carefully review this profile and provide comments so that future versions might be improved. All questions and comments about this profile should be addressed to: usgv6-program@list.nist.gov.1

1.2. Profiling IPv6 Capabilities

The technical specification of capabilities required by modern networking products is inherently complex. While some use the term “IPv6” as if it were a single, monolithic technology with a simple concise technical definition, the reality is quite different. The complete specification of the range of IPv6 capabilities commonly found in products requires reference to scores of individual protocol, architecture, and algorithm specifications. While this profile provides some background and rationale about the choices that are contained within it, it is well beyond the scope of this document to provide a tutorial on these technologies and specifications.

Some of the IPv6 capabilities in this profile are defined in terms of protocol and algorithm specifications that are not specific to IPv6. In fact, many such specifications may not mention IPv6 at all. Examples include various application layer and security services.

Although these specifications may have been written with IPv4 in mind, when referenced in this profile, the understanding is that the requirements apply to IPv6 networking. In addition, some specifications for IPv6 capabilities may only define the required changes from the corresponding IPv4 capability. In these cases, the implied requirement is to also support the unchanged functions from the IPv4 specification.

This profile establishes a taxonomy of IPv6 capabilities that are defined primarily in terms of

IETF specifications. The result is a collection of labeled IPv6 capability definitions for common network functions, applications, services and usage scenarios. The design choices for the granularity and composition of individual named IPv6 capabilities in this profile are guided by several factors including (1) a judgement of the protocol capabilities that are common to all IPv6 products, and the capabilities that differentiate individual IPv6 products,

(2) an assessment of when multiple specifications are necessary to fully implement a given user visible functionality, and (3) the granularity and organization of existing industry defined conformance and interoperability tests [IPv6-Ready]. As such, some labeled capabilities in this profile map one-to-one to specific IETF protocol specifications (or parts of specifications), and some labeled capabilities map to a set of two or more distinct protocol specifications.

By default, each labeled capability adopts by reference the normative requirements of the cited specifications. In rare cases the profile may augment or modify the normative requirements of a base specification. These labeled capability sets effectively form a vocabulary for expressing technical requirements for IPv6 products, and for testing, documenting and reporting IPv6 capabilities of specific products. By using the same vocabulary to express requirements and to report product capabilities, this profile facilities the efficient comparison of user requirements with vendor offerings.

1 To subscribe to this discussion list, email: usgv6-program+subscribe@list.nist.gov.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

This profile provides the means by which its users can develop requirement specifications for

IPv6 capabilities in a wide range of networked IT products and services. Users of this profile can develop IPv6 requirement statements for specific networked IT products and services directly from the NISTv6 Profile, or they might develop their own requirements profiles, derived from this specification as a base, but with the additional guidance and requirements suitable for their user group.

Figure 1 NIST IPv6 Profile usage scenarios.

It is expected that, when combined with specific user group requirements profiles and product testing programs, this profile can facilitate the efficient acquisition and adoption of

IPv6 technologies in many industry sectors.

1.3. Profile Structure: Functional Roles and Capability Groups

Often IETF specifications are written to describe the normative behavior of multiple parties in a distributed protocol. Often the technical requirements of each party are different based upon the functional role they play in the protocol. The most common functional roles distinguished in IETF specifications are those of Hosts and Routers. Many protocols describe both the required behavior for Hosts and for Routers in a single specification. An individual implementation of such a protocol typically only supports the requirements for either Hosts or Routers depending up the purpose of the product. To carefully specify, test and report such differing capabilities, we need to distinguish between a few common functional roles in our profile.

One approach to dealing with this need is to produce separate labeled capability variants for each functional role. In some cases where the functional role differences are limited to a single protocol, we do this (e.g., “DHCP-Client”, “DHCP-Server”). But in case of Hosts and h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Routers, the differences span many capabilities and specifications. To enable concise specification of these varied requirements we partition our profile to describe Host and

Router IPv6 capabilities separately.

This profile defines the following functional roles:

• Router – an IPv6 implementation that forwards packets not explicitly addressed to itself. A Router implementation’s primary purpose is to support the control protocols necessary to enable interconnection of distinct IP sub-networks by IP layer packet forwarding.

• Host – an IPv6 implementation that is not a router. A Host implementation’s primary purpose is to support application protocols that are the source and/or destination of IP layer communication.

• Other – products that implement IPv6 capabilities that are neither standard Host nor

Router functions. Currently the profile identifies three additional roles for such products:

o Network Protection Product (NPP) – an IPv6 product which provides network protection functions (e.g., firewalls, intrusion detection / prevention).

For security reasons, such products often have only partial, or non-standard, Host and/or Router capabilities. For this reason, and because this profile only specifies the protection capabilities required for these products, we call them out using a distinct functional role.

o Switch – a product which provides layer-2 (i.e., sub IP layer) switching, but needs to support IPv6 specific functions for security and performance reasons.

o Application and Services – a network enabled application or service that does not directly implement IPv6 protocols (e.g., typically these are implemented by an underlying distinct product such as an operating system) but must operate on IPv6 enabled systems and IPv6 networks.

In the sections that follow, we organize our lists and textual descriptions of capabilities into groups of related functions (e.g., “Security Capabilities”, “Routing Capabilities”). These groupings are purely for the convenience of organizing the large range of capabilities described by this profile, and to allow users to easily see related capabilities which may represent alternatives for the same basic functions. Such groupings have no technical impact on the use of this profile and could have been omitted without any normative impact.

1.4. Profiling Products and Implementations.

The purpose of this profile is to support the precise technical specification of IPv6 requirements for networked information technology, and to enable documentation of the IPv6 capabilities of individual products. There is a vast variety of networked IT products and systems in the world today, ranging from supercomputers to systems on a chip and from carrier class routers to home wireless access points. It is impossible to develop a priori a static taxonomy of products that would adequately and flexibly capture such a vast range of offerings. Instead, our approach is to provide a common vocabulary for expressing the h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2 requirements and capabilities of individual implementations, thus enabling users to developed unique detailed descriptions of nearly any product.

Even within a single product or system, it is often the case that there are multiple distinct implementations of network protocols and functions. These individual implementations, often called “protocol stacks”, may have different capabilities and even different functional roles. For example, an IPv6 Router may well have one or more Host stacks to support network management and configuration functions. It is important to document the requirements and capabilities of all network functions in each product, not just those associated with its main purpose.2

Profile Scope, Applicability and Conventions

The following section provides context information for the general interpretation and use of this profile. Users of this specification that need to alter the information that follows are encouraged to do so explicitly in a separate derivative document. While derivative works are encouraged when necessary, care should be taken to avoid unnecessary duplication of specification and/or potentially conflicting guidance.

2.1. Scope and Applicability

This profile was developed to assist in the acquisition of robust, IPv6 capable networked IT products. The capabilities identified in this profile represent the union of those viewed as being necessary to enable production IPv6 deployment in a wide range of usage scenarios.

While this profile is designed to allow users to specify what IPv6 capabilities are required in products being purchased for specific deployment scenarios, it is beyond the scope of this profile to address operational concerns such as deployment plans, coexistence and transition schemes to ensure interoperability with legacy IPv4 infrastructure, or specific approaches to securing individual network environments.

Planning for IPv6 deployment in production IT systems is a complex undertaking. There is a large, and ever growing, knowledge base of industry developed specifications and guidance in this area. The IETF IPv6 Operations (v6ops) [IETF-V6OPS] and Operational Security

Capabilities for IP Network Infrastructure (opsec) [IETF-OPSEC] working groups are sources of numerous operational guides addressing deployment plans for various environments (e.g., enterprise networks, Internet service providers, cellular networks), security considerations and guidance, and transition and interoperability approaches for deployment in legacy networks.

2.2. Life Cycles and Change Management.

This document is the first major structural and technical revision of an IPv6 profiling effort first published in 2008. While IPv6 technologies and product offerings have matured and

2 It is not uncommon to find products that claim to support IPv6 but are not fully functional in IPv6-only environments. Typically, it is the configuration, management and maintenance interfaces / stacks that are lacking full IP6 support.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2 stabilized significantly over that period, they continue to evolve. Future revisions of this profile are expected to maintain the structure and format of this document, while only modifying the technical definitions of IPv6 capabilities within.

When a profile revision changes or adds significant new technical capabilities, it is unreasonable to expect the product and testing industry to be able to respond immediately.

As a general principle, we recommend waiting at least 24 months between the addition of a significant new capability to the profile and its citation as a procurement requirement.

Profile updates that are more incremental (e.g., errata, updates to existing capabilities) may be operative in less time. The profile capabilities table, marks all changes in capability requirements as being either new, or an update to existing previous requirements (see section

2.4)

Going forward, we expect to issue updates to this profile every two years. In general, when new revisions of the profile are published, we recommend that users cite the most recent version of this profile when appropriate and always include a specific indication of the version being referenced.

2.3. Statements of Requirements Levels

In general, the terminology used to describe requirements levels in this specification include:

“mandatory”, “optional” (with their common meaning), and "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and

"OPTIONAL" which are to be interpreted as described in [RFC2119].

2.4. Profile Capabilities Table.

The NISTv6 Capabilities Table (NCT) provides a concise tabular summary of the technical requirements of this profile. For ease of reference, the NCT is maintained as supplemental information to this profile and provided in a separate document. Readers are encouraged to access and review the NCT as an adjunct to this document.

• NISTv6-r1 Capabilities Table - https://doi.org/10.6028/NIST.SP.500-267Ar1s

The NCT is interpreted as follows:

• The NCT is organized in rows of references to IPv6 technical specifications, or specific subsections of specifications. The Reference, Section and Title columns provide the full context for each cited specification. For ease of readability if the

Reference column is empty, the last Reference from the rows above is understood.

• The Flag column indicates changes from previous versions of the profile.

o “N” indicates that an RFC is new and wasn’t in the previous revision of the profile.

o “U” indicates that the RFC has been updated since the previous revision of the profile.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2 o If the Flag Column is blank it indicates there is no change from the last revision of the profile.

• The Capabilities column defines the capability label (or conjunction or disjunction of multiple capabilities) that indicates support of the referenced technical specification.

Capabilities may be logically joined with “|” and “&”. The “|” stands for “or” indicating that having either capability will satisfy the requirement. The “&” stands for “and” indicating that both capabilities must be met to satisfy the requirement.

o Some capability labels contain an “=” symbol. This is just a notational convenience to allow such labels to be easily grouped by name.

• The Host, Router and Other columns provide profile specific guidance for products in each specific functional role (see section 1.3). The values in each column provide recommendations as to which capabilities should be considered mandatory (M), optional (blank), or not recommended [X]. Entries with the notation “O:1” indicate that at least one of the listed capabilities is recommended to be selected. Entries that are grayed out in any of these columns indicate that the corresponding specification is typically not applicable to products in that functional role.

o The capability selection guidance in provided in this profile is derived from the IETF IPv6 Node Requirements specification [RFC8504]. That is, the capabilities marked “M” in the NCT correspond to those specifications that are indicated as MUST in RFC 8504.

While the NCT is a complete tabular summary of the normative content of this profile, readers are encouraged to consult section 3 for guidance on how to interpret the NCT for the purpose of developing requirement statements and to consult section 4 for guidance on interpreting the NCT for the expression of the capabilities of individual products.

2.5. Capability Summary Strings.

The primary purpose of this profile is to establish a vocabulary for expressing the IPv6 requirements for networked IT and documenting the IPv6 capabilities of specific products.

The named IPv6 capability sets defined in the profile form the terms for this vocabulary. We form Capability Summary Strings (CSS) from these terms to define a single specific requirement statement or to document the capabilities of a specific product.

Capability Summary Strings have the following syntax:

CSS_Name = Profile:Functional_Role + Capability + Capability + …

The following is an example of a specific CSS:

Example-Desktop-PC = NISTv6-r1:Host + IPv6-Only + Core + Addr-Arch + Multicast + [DHCP-Client | SLAAC] + Link=Ethernet

CSS definitions are used to develop both requirement statements and to document product capabilities. Use the following guidance to develop and interpret capability summary strings.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

• CSS_Name – A shorthand name for the part of the CSS to the right of the “=” sign.

The CSS_Name has only local significance and should be fully defined in a complete

CSS before its use in isolation. If a CSS_Name is defined in a document, then one can refer to a complete specification by referring to both the source document and the

CSS. Two strings with the same CSS_Name are understood to be multiple parts of a single requirement or product description.

• Profile – The name of the specific profile and version that establishes the technical definitions of the capabilities and roles used in the CSS.

o NISTv6-r1 is the profile name associated with this document.

• Functional_Role – One of the functional roles identified in the cited profile.

o Host, Router, NPP, Switch, and App-Serv – are the functional roles identified in this profile.

• Capability + Capability + … - A list of capability labels concatenated with “+” signs enumerating the IPv6 capabilities that comprise the CSS. When used as a requirement statement the capability list should be viewed at the minimal required set of capabilities necessary. When used to document a specific product, the list should include all the capabilities supported by the product.

o When used as a requirement statement the capability list may indicate that any of a list of capabilities can fulfill the requirement. This is the equivalent of

“O:1” notation in the NCT. In the example above, “[DHCP-Client | SLAAC]” indicates that at least one of these capabilities MUST be supported.

o When used to describe the capabilities of a specific products, support for multiple alternatives is expressed by simple concatenation of labels with “+”.

For example, a product that supported both forms of address configuration mentioned above would simply include the substring “… + DHCP-Client +

SLAAC + …”.

o In circumstances when a capability specification requires a standard that is not included in a capability defined by this profile, the CSS can be augmented with direct reference to the normative standard “ … + RFC3261 + …”.

As previously noted, real networked IT products often contain multiple logically or physically distinct IPv6 protocol stacks that may perform different functional roles as defined in this profile. For example, an IPv6 Router that also includes Host functions to support its configuration and management. It is not uncommon to require multiple CSS to fully describe the IPv6 capabilities of a modern IT product.

The flexibility provided by CSS specifications can represent a vast range of capabilities and features found in modern networked IT products and services. Having this flexibility avoids the artificial constraints of standardizing a priori a small set of product configurations that could not possibly capture the full variety of current or future networked IT products.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

2.6. Conformance, Testing and Reporting.

This profile establishes the means to describe the IPv6 capabilities required of and implemented by networked IT products. Users of this profile will rely on capability summary strings to document both IPv6 requirement statements and product capabilities.

Those developing procurement specifications will use this profile to develop or cite specific

CSS that define the IPv6 capabilities required in product offerings.

Figure 2 Development of IPv6 procurement requirements.

Vendors will use this profile to document the IPv6 capabilities of their products as well. It is meaningless to claim conformance to this profile alone. The only meaningful statement of product conformance is to a specific CSS that has been defined in terms this profile. In general, it is envisioned that vendors will document the IPv6 capabilities of their products by reporting CSS that include all the IPv6 capabilities supported by a specific product.

In many situations users may desire additional assurances of the completeness, correctness and interoperability of the IPv6 capabilities provided by vendor products. In these situations, specific user groups may develop additional guidance on testing and reporting requirements for vendor supplied CSS. Testing guidance might require demonstrated conformance and/or interoperability testing results (potentially from independent testing sources) and/or specific additional means of documenting and reporting the results from such testing.

Figure 3 Documenting IPv6 product capabilities h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

User groups wishing such levels of additional assurance are encouraged to fully document the details of how such detailed testing and reporting mechanisms are to be conducted and how they will result in the derivation of one or more CSS for individual products.

When both purchasers and vendors use CSS statements based upon this profile, it should be possible to perform a simple matching function to determine if a product offering satisfies a specific requirement statement.

Figure 4 Matching IPv6 procurement requirements to product capabilities.

While the goal of this profile is to enable users and vendors to compare and match stated requirements to the documented capabilities of products, the profile and CSS derived from it are still valuable if only one side of this process is exercised. Product capability summary strings are useful “full disclosure” statements of the IPv6 features that purchasers can expect, even if a corresponding CSS requirement statement was not provided.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Selection of IPv6 Capabilities

The subsections that follow provide templates to facilitate the selection of capabilities for the purpose of developing requirement statements. The subsections are organized by the functional roles identified in this profile (i.e., Host, Router, NPP, App-Serv). Within each subsection capabilities are arranged in groups of related functions (e.g., Addressing

Capabilities, Routing Capabilities).

For each capability a recommended requirement level is indicated. The notations used to indicate the requirement level of each capability include:

• [M] – Mandatory, it is recommended that this capability be included in all CSS for this functional role. For example, all Host CSS should include the Core capability.

• [O:1]=[Capability1 | Capability2] – Choice, it is recommended that at least one of the listed capabilities be included in all CSS for this functional role.

• [O] – Optional, the profile user can choose to include this capability in CSS as needed. Note, in capability tables, optional is denoted by a blank cell.

• [X] – Not recommended for the profile uses described in the scope and applicability section. Such capabilities are included in the profile to maintain alignment with other profiles and/or to document the full range of possibilities.

Users should be conservative in the selection of optional capabilities when developing requirement statements. While there are many optional capabilities defined in this profile, they vary in their common availability in commodity network IT products. Users are recommended to survey the documented IPv6 capabilities of relevant products and/or to interact with potential vendors / system developers / integrators as part of the process of developing CSS requirement statements.

To further understand the detailed technical definition of the capabilities below, see the corresponding entries in the NISTv6-r1 Capabilities Table (section 2.4) and section 4

Technical Definition of IPv6 Capabilities. See section 5 for example CSS that incorporate these capabilities.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

3.1. IPv6-Only Capabilities

There is no standard definition of what it means for products to capable operating in “IPv6-only” networks. This profile defines the IPv6-Only capability as requiring a product to support the full lifecycle of operation (i.e., product installation, configuration, operation, management, instrumentation, and update) in environments with no IPv4 capabilities (e.g., either IPv4 is not implemented or is administratively disabled).

A product claiming support of the IPv6-Only capability must be fully functional when deployed in an IPv6-only network.

The IPv6-Only capability applies to a product as a whole and is applicable to each functional role defined in this profile. The technical definition of this capability is provided in section

4.1 of this profile but is the same for all product types. For the sake of clarity, we summarize these capabilities in a single location here.

NISTv6-r1:Host Capabilities:

• IPv6-Only Capabilities – see section 4.1 o [O] – IPv6-Only - support for full product functionality on an IPv6-only network

NISTv6-r1:Router Capabilities:

• IPv6-Only Capabilities – see section 4.1 o [O] – IPv6-Only - support for full product functionality on an IPv6-only network

NISTv6-r1:NPP Capabilities:

• IPv6-Only Capabilities – see section 4.1 o [O] – IPv6-Only - support for full product functionality on an IPv6-only network

NISTv6-r1:Switch Capabilities:

• IPv6-Only Capabilities – see section 4.1 o [O] – IPv6-Only - support for full product functionality on an IPv6-only network

NISTv6-r1:App-Serv Capabilities:

• IPv6-Only Capabilities – see section 4.1 o [O] – IPv6-Only - support for full product functionality on an IPv6-only network

3.1.1. Selecting IPv6-Only Capabilities

Users of this profile may require any product to be capable of operating in IPv6-only environments.

• Common dual-stack deployments may not require IPv6-Only capabilities today, but there are several user group initiatives targeting migration to IPv6-only network infrastructures.

• Future revisions of the profile will likely recommend IPv6-Only as a mandatory requirement for all networked IT systems.

• When the IPv6-Only capability is indicated, it is implied that all other specified capabilities of a product, must operate in IPv6-only environments.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Note: At the time of publication of this document, few commercial products are fully capable of IPv6-only operation. Users of this profile should carefully consider the state of the marketplace before selecting this capability.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

3.2. Host Capabilities

A template of the various Host capabilities is given below along with references to sections of this profile that provide further discussion and interpretation of the requirements.

NISTv6-r1:Host Capabilities Template:

• IPv6-Only Capabilities - see section 4.1 o [O] - IPv6-Only - support for full product functionality on an IPv6-only network.

• Basic Capabilities - see section 4.2 o [M] - Core - support for IPv6 core functions.

o [O] - Extended-ICMP - support for ICMPv6 extended messages.

o [O] - PLPMTUD - support for Packetization Layer Path MTU Discovery.

o [O] - ND-Ext - support for Neighbor Discovery enhanced DAD and First-Hop Selection.

o [O] - ND-WL - support for packet-loss for router solicitations.

o [O] - SEND - support for neighbor discovery security extensions.

o [M] - SLAAC - support for stateless global address auto-configuration.

o [O] - PrivAddr - support for SLAAC privacy extensions.

o [O] - DHCP-Stateless - support for stateless (DHCP) configuration.

o [O] - DHCP-Client - support for stateful (DHCP) address auto-configuration.

o [O] - DHCP-Client-Ext - support for additional DHCP options including SIP.

o [O] - DHCP-Prefix - support for stateful (DHCP) prefix delegation.

o [O] - DHCP-Prefix-Ext - support for additional DHCP options for prefix exclude using prefix delegation.

o [O] - 6Lo - support for IPv6 over low power networks.

o [O] - Happy-Eyeballs - support for Happy Eyeballs algorithm for dual stack environments.

• Addressing Capabilities - see section 4.7 o [M] - Addr-Arch - support for address architecture and selection.

o [O] - CGA - support for cryptographically generated addresses.

• Network Support Capabilities - see section 4.11 o [O] - DNS-Client - support for DNS client/resolver functions.

o [O] - URI - support for IPv6 uniform resource identifiers.

o [O] - NTP-Client - support for NTP client capabilities.

o [O] - NTP-Server - support for NTP server capabilities.

o [O] - DNS-Server - support for DNS server capabilities.

o [O] - DHCP-Server - support for DHCP server capabilities.

o [O] - DHCP-Server-Ext - support for DHCP server additional DHCP options and Bulk

Leasequery.

o [O] - DHCP-Relay - support for DHCP relay capabilities.

• Security Capabilities - see section 4.8 o [O] - IPsec - support for the IP security architecture.

o [O] - IPsec-IoT - support for IoT Cryptographic Algorithms.

o [O] - IPsec-CHACHA - support for ChaCha20 Cryptographic Algorithms.

o [O] - IPsec-SHA-512 - support for SHA-512 Cryptographic Algorithms.

o [O] - SSHV2 - support for SSHv2 over IPv6.

o [O] - TLS - support for Transport Layer Security architecture version 1.2.

o [O] - TLS-1.3 - support for Transport Layer Security architecture version 1.3.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

• Transition Mechanism Capabilities - see section 4.5 o [O] - Tunneling-IP - support for generic packet encapsulation tunnels using IPv6.

o [O] - Tunneling-UDP - support for generic packet encapsulation tunnels using UDP.

o [O] - XLAT - support for transition mechanism 464XLAT.

o [O] - NAT64 - support for transition mechanism NAT64.

o [O] - DNS64 - support for transition mechanism DNS64.

• Network Management Capabilities - see section 4.9 o [O] - SNMP - support for simple network management protocol.

o [O] - NETCONF - support for network configuration functions.

• Multicast Capabilities - see section 4.10 o [O] - SSM - require full support for multicast communications.

o [M] - Multicast - support for link-local multicast communication.

• Quality of Service Capabilities - see section 4.4 o [O] - DiffServ - support for Differentiated Services capabilities.

o [O] - ECN - support for Explicit Congestion Notification.

• Link Specific Capabilities - see section 4.6 o [O] - Link=Ethernet - support for IPv6 over Ethernet.

o [O] - Link=PPP - support for IPv6 over PPP links.

o [O] - Link=G.9959 - support for IPv6 over Z-Wave.

o [O] - Link=Bluetooth - support for IPv6 over Bluetooth.

o [O] - Link=BACnet - support for IPv6 over BACnet.

o [O] - Link=6LoWPAN - support for IPv6 over 802.15.4.

3.2.1. Selecting Host Capabilities

The following guidance is provided for selecting capabilities from this section.

• Core, SLAAC, Multicast, and Addr-Arch capabilities are recommended to be mandatory in all systems.

• For systems that will be deployed on potentially lossy networks with specific features, users will want to consider requiring neighbor discovery and compression extension capabilities of ND-WL and 6Lo.

• IPv6 Neighbor Discovery has several optional updates that provide optimizations in some use case scenarios. Users may want to require ND-EXT for a more robust solution in these deployment scenarios.

• User may want to require additional methods to mitigate packet loss due to fragmentation. An alternative to Path MTU Discovery required in Core is

Packetization Layer Path MTU Discovery (PLPMTUD) designed for use over paths where end-to-end delivery of ICMPv6 messages is not assured.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

• Capabilities to secure neighbor discovery include ND-SEND and CGA. Note, to date these capabilities are not commonly implemented in commodity systems and should be required only when necessary.

• Privacy addressing features are provided by the PrivAddr capability. Note: Certain use cases, such as Enterprise deployments, may not want this capability enabled as it makes tracking IP addresses difficult.

• Systems that will use stateful address and configuration management (i.e., DHCPv6) should require DHCP-Client. DHCP-Prefix allows for assigning address ranges to a system that will sub-allocate addresses to other nodes and network functions. DHCP- Stateless should be required when SLAAC is the only supported address configuration protocol and additional network configuration information is necessary.

• DHCP-Client-Ext includes support for additional DHCPv6 options including SIP.

DHCP-Prefix-Ext adds support for the Prefix Exclude Option.

• Happy-Eyeballs is an algorithm that enhances the robustness and performance of dual-stack systems by trying to contact remote systems with both IPv4 and IPv6 in parallel. Whichever protocol receives the first response is used for the remainder of the communication. Edge Dual stack networks should consider requiring this capability.

• The capability to operate DNS over IPv6 is available for both client and server. The

DNS-client and DNS-server capabilities require products to support DNS resolution for IPv6 address records and for DNS queries over native IPv6.

• Users of DHCPv6 for network addressing and information will want to select DHCP- Server for the systems managing network address and configuration information.

Additional DHCPv6 Server functions, such as Bulk Leasequery, are included in

DHCPv6-Server-Ext that may be required for advanced DHCPv6 deployments.

• Users requiring support for the Network Time Protocol will want to require NTP-server and NTP-client capabilities where appropriate.

• Secure end-to-end communications channels can be required by selecting either TLS, SSH or IPsec capabilities. IPsec-IoT, IPsec-CHACHA, IPsec-SHA-512 are additional algorithms and must only be selected when IPsec is selected. The IPsec-VPN capability is for secure data plane channels in router products. Similarly, IPsec-IOT- VPN, IPsec-IOT-CHACHA-VPN, and IPsec-SHA-512-VPN must only be selected when

IPsec-VPN is selected.

• The SSHv2 capability defines the suite of RFCs for supporting SSHv2 over IPv6.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

• The TLS capability is currently defined in terms of the TLS1.2 specification. The TLS-

1.3 capability is available for users that need the enhanced security features of the new specification and understand the operational implications of its use.

• Users have several…