ISATAP Tunnel MTU

The ISATAP tunnel MTU is currently recommended to be set to 1480 . This is to avoid IPv4 fragmentation within the tunnel , but requires the ISATAP tunnel ingress interface to drop any IPv6 packet larger than 1480 bytes and return an ICMPv6 Packet Too Big (PTB) message . Concerns for operational issues with both IPv4 and IPv6 Path MTU Discovery point to the possibility of MTU-related black holes when a packet is dropped due to an MTU restriction, so dropping packets is considered highly undesirable. Fortunately, the "Internet cell size" is 1500 bytes, i.e., the minimum MTU configured by the vast majority of links in the Internet, such that 1500 byte or smaller packets are likely to be delivered without loss to MTU limitations in the vast majority of cases. This document therefore presents a method to boost the ISATAP tunnel MTU to 1500 bytes. Pushing the ISATAP tunnel MTU to 1500 bytes is met with the challenge that the addition of the IPv4 encapsulation header would cause a 1500 byte IPv6 packet to appear as a 1520 byte IPv4 packet on the wire. This can result in the packet being either fragmented or dropped by an IPv4 router that configures a 1500 byte link, depending on the setting of the "Don't Fragment" (DF) bit in the IPv4 header. Using the approach outlined in this document, the ISATAP tunnel avoids this issue by performing IPv6 fragmentation on the inner IPv6 packet before IPv4 encapsulation. The approach is outlined in the following sections.

Setting the ISATAP MTU to 1500 bytes is accomplished via the following algorithm:

In the algorithm given in Section 2, the ISATAP tunnel interface MTU for ISATAP hosts and/or routers can be set to 1500 bytes independently of other ISATAP interfaces within the site, i.e., the approach is incrementally deployable. The algorithm in Section 2 further ignores the IPv6 requirement that routers in the network must not fragment IPv6 packets, i.e. fragmentation must be performed only by hosts. However, we observe that the ISATAP host is allowed to perform IPv6 fragmentation. We further observe that the ISATAP router is tied through stateless address mapping to a single ISATAP host such that the fragments would not be delivered to multiple hosts. The algorithm in Section 2 requires that ISATAP ingress tunnel endpoint perform IPv6 fragmentation (when necessary), but the ISATAP egress tunnel endpoint does not perform reassembly; hence, the ISATAP tunnel endpoints remain stateless. Instead, the final destination IPv6 host may be obliged to reassemble IPv6 packets up to 1500 bytes in length, but hosts are required to reassemble at least that much by the IPv6 standard . Since the ISATAP tunnel endpoints set the Identification field in fragmented IPv6 packets to a random 32-but value, there is no possibility for "serialization" in which an IPv6 host might find the number of distinct outstanding Identification values reduced due to the ISATAP tunnel endpoint applying a single serial Identification value for all IPv6 hosts. And, the use of a random 32-bit value would still allow for far more than enough outstanding IPv6 packet reassemblies without risk of colliding Identification values.

There are no IANA considerations for this document.

The security considerations for ISATAP apply also to this document.

This method was inspired through discussion on the IETF v6ops list in the May 2012 timeframe.