RSIP
Address Sharing with End-to-End Security
Mike Borella, 3Com Corp.
Gabriel Montenegro, Sun Microsystems
March 2000
Where is the Network Edge?

Yesterday:
– Corporations
– Universities

Today:
– Homes
– Cell phones, PDAs

Tomorrow:
– Everywhere




Hotels
Airports
Conference centers
“Gas stations on the Information Superhighway”
Realm Specific IP
page 2
The Expansion of the Edge has
Accelerated the IP Address Shortage

About 4 billion total, but...
–
–
–
–
Heavy allocation to North America and Europe
Many unused (old Class A blocks)
Limited by routing architecture (prefixes, CIDR)
Conservative allocation policies


Typically must demonstrate both need and usage
Heterogeneity implies that address space usage
count is intractable!
– Perhaps as many as 50% unallocated
– Given current growth trends, these wouldn’t last long on
the open market
Realm Specific IP
page 3
The Solution So Far…
Network Address Translation (NAT)

Multiple hosts share one address
– NAT router re-writes packet headers to same public IP
– Application proxies for protocols that transmit addresses
and ports

On the down side...
– Difficult to maintain and manage
– Breaks IPSEC -> no VPNs
– Doesn’t work well with many next-generation protocols


mobile IP, multicast, RSVP, etc.
Nonetheless, very widespread deployment
Realm Specific IP
page 4
NAT in a Nutshell
Local SRC IP
DST IP
Local SRC Port
Assigned SRC Port
DST Port
10.0.0.4
192.156.136.22
1192
12300
80
NAT Router
Internet
10.0.0.4
10.0.0.1
149.112.240.55
192.156.136.22
SRC IP:
192.156.136.22
10.0.0.4
SRC Port:
1192
80
SRC IP:
192.156.136.22
149.112.240.55
SRC Port:
80
12300
DST IP:
192.156.136.22
10.0.0.4
DST Port:
1192
80
DST IP:
149.112.240.55
192.156.136.22
DST Port:
12300
80
Realm Specific IP
page 5
NAT Needs ALGs for Address and
Port Content in the Payload
FTP control packet from private host arriving at NAT router
Source IP address
(10.0.0.4)
Source TCP port
(1025)
Destination IP address
(192.156.136.22)
Destination TCP port
(21)
IP
Header
TCP
Header
Payload
(IP = 10.0.0.4, Port = 1026)
Figure out protocol, look into packet, translate addresses and
ports, change TCP sequence number, maintain running delta for
lifetime of connection…yuck!
Realm Specific IP
page 6
Realm Specific IP (RSIP)

RSIP goals
–
–
–
–

Alternative to NAT on same network architecture
less computation at router
No need for ALGs
IPSEC integration possible
Use header tuples (e.g., ports, SPIs) to extend
IP address space
– IP addresses and tuples from the public routing realm
are leased by private hosts
– Assignments are made such that incoming packets
can always be demultiplexed properly
Realm Specific IP
page 7
RSIP in a Nutshell
Local SRC IP
DST IP
Assigned Port
Assigned IP
DST Port
10.0.0.4
192.156.136.22
1192
149.112.240.55
80
RSIP Router
Internet
10.0.0.4
10.0.0.1
149.112.240.55
192.156.136.22
SRC
IP: SRC IP:SRC Port: SRC Port:
SRC IP: SRC
SRC
SRC IP:
SRC Port:
SRC
Port:
SRC IP:
IP: IP:
149.112.240.55
192.156.136.22
10.0.0.4
10.0.0.1
10.0.0.1 Address
149.112.240.55
192.156.136.22
10000
21 149.112.240.55 21
10000
and port
request
DST
IP: DST IP: DST Port: DST Port:
DST IP: DST
DST
DST IP:10000-10015
DST Port:
DST
Port:
DST IP:
IP: IP:
149.112.240.55
10000
10.0.0.1
10.0.0.4
10.0.0.4 192.156.136.22
149.112.240.55
21
10000 192.156.136.22
21
Realm Specific IP
page 8
RSIP vs. NAT

Similarities
– Demultiplex on tuples (e.g., addresses, port numbers)
– Mapping kept by server/router

Differences
– NAT: Router modifies packets, host oblivious
– RSIP: Host asks router how to make packets “Internet
ready”
– NAT: No modifications to host, protocol support in router
– RSIP: Host modified but no protocol support required in
router
Realm Specific IP
page 9
RSIP Protocol

Lightweight negotiation between RSIP servers and
hosts of arbitrary parameters
–
–
–
–
“Network” and “control” resources
Vendor-specific parameters
Error reporting
Transport agnostic


may be TCP or UDP (we use port 4455)
Message and parameter formats allow extensibility
beyond our specification
– E.g., IPSEC SPIs, ISAKMP cookies, PPTP call IDs, etc.
Realm Specific IP
page 10
Registration
RSIP Server
10.0.0.4
10.0.0.1
149.112.240.55
REGISTRATION_RESPONSE
(client ID = 2, REGISTRATION_REQUEST
flow policy = local micro, remote macro)
Realm Specific IP
page 11
Assignment
RSIP Server
10.0.0.4
10.0.0.1
149.112.240.55
ASSIGN_RESPONSE_RSAP-IP
(client ID = 2, bindASSIGN_REQUEST_RSAP-IP
ID = 1, local addr = 149.112.240.55, local port =
12345, remote
addr
port
= X,
lease = 3600,
(client
ID == 128.153.4.3,
2, local addr remote
= X, local
port
= X,
tunnel = IPIP)
remote addr = 128.153.4.3,
remote port = X)
Realm Specific IP
page 12
IPSEC

Two related, but independent modules:
– Secure encapsulation and transport (ESP, AH)

Rather straightforward
– Secure key exchange (IKE, ISAKMP, OAKLEY)

Rather complicated
Realm Specific IP
page 13
IPSEC Encapsulation and Transport
Encrypted
Source IP address
(149.112.60.12)
Destination IP address
(192.156.136.22)
IP
Header
SPI
(2240768201)
ESP
Header
Source TCP port
(1025)
Payload
(HTTP)
Destination TCP port
(80)
TCP
Header
HASH
ESP
Trailer
Authenticated
Realm Specific IP
page 14
RSIP with IPSEC

ESP encrypts all ports: can’t use them to
demultiplex!
– Use SPI instead
– Additional negotiation: ASSIGN_REQUEST_RSIPSEC

IPSEC client module must:
– Use ephemeral IKE source port


Otherwise I-Cookie routing necessary - more negotiation
Using default IKE port may cause rekeying problems
– Acquire SPI values from RSIP module
Realm Specific IP
page 15
Remote Access from Airport Kiosk
Corporate
Network
Mobile Client
56K or
less
Address
Shortage
Internet
Airport LAN
Security
NAT Router
Security
Realm Specific IP
page 16
Secure VPN Enabled by RSIP
Mobile Client
w/ RSIP
Corporate
Network
Secure Virtual Tunnel
RSIP-enabled
address sharing
Internet
Airport LAN
RSIP Router
Realm Specific IP
page 17
RSIP and IPv6?

Part of a dual-stack transition mechanism?
IPv4/IPv6 dual
stack subnet
IPv4 only subnet
IPv4 Internet Backbone
IPv4/IPv6 dual
stack subnet
IPv6 only subnet
Realm Specific IP
page 18
Current Status in the IETF
draft-ietf-nat-rsip-protocol-06.txt
 draft-ietf-nat-rsip-framework-04.txt
 draft-ietf-nat-rsip-ipsec-03.txt
 draft-ietf-nat-rsip-slp-00.txt
 draft-ietf-dhc-nextserver-02.txt

Realm Specific IP
page 19