Back in 2009 (!) I described the theory behind how a mobile network assigns an IPv6 Prefix to a mobile device. 3GPP TS 23.221 and TS 23.060 are a good starting point. 6 years later things have moved from theory to practice so I decided to write another blog entry on the topic, this time with some more details out of traces made in a live network.
IPv6 Prefix and Interface Identifiers
Unlike in IPv4, the network does not assign an IPv6 address to a mobile. In IPv6 a router advertises an IPv6 prefix and each device receiving the advertising packet can choose its own network identifiers that are the second part of a full IPv6 address. This is standard IPv6 procedure and nothing that is specific to mobile. If you are not quite familiar with IPv6 prefixes and network interface identifiers have a look at parts 1 to 4 of my IPv6 overview from back in 2009 (here, here, here and here).
Requesting A Prefix From the Network
To get an IPv6 prefix from the network the first thing the mobile device does is to request an IPv6 or IPv4v6 default bearer. In LTE this is done in the PDN Connectivity Request message that is sent as part of the LTE Attach process. In the message the following two information elements are included:
PDN type: IPv4v6 [...] Protocol or Container ID: DNS Server IPv6 Address Request (0x0003)
As this and other messages described below are rather long, I’ve decided to only show the parts relevant for IPv6 in this post. The first information element is the PDN type which can be set to IPv4, IPv6 or to IPv4v6 to get both an IPv4 address and an IPv6 prefix. In the example above the mobile requests both IPv4 and IPv6 connectivity. The second information element is necessary to get an IPv6 DNS Server address to be able to perform domain name resolution later on.
ESM Information Request and Response
In practice, most LTE devices and networks are configured in a way that the network has to ask the mobile device for the Access Point Name (APN) during the attach process. This is done with an ESM (Session Management) Information Request message sent from the network once the device has been authenticated and encryption has been activated. The mobile responds with an ESM Information Response message that contains, among other things, the APN name and once again the request to send an IPv6 DNS Server address.
Activate the Bearer
The network then assigns an IPv4 address and IPv6 prefix and instructs the mobile to establish an LTE ‘bearer’ with the Activate Default Bearer Request message. The message contains the following information elements relevant to IPv6:
PDN address PDN Type: IPv4v6 PDN IPv6 Interface ID: 0002:0001:c731:f114 [...] Container ID: DNS Server IPv6 Address IPv6: 2a12:577:733:0:10:74:312:312
The IPv6 PDN address is not an IPv6 address but merely the interface identifier the mobile shall use together with the link local IPv6 prefix in the stateless IPv6 address auto-configuration (SLAAC) procedure that will follow. In other words while the network does assign an IPv4 address in the message, it does not assign an IPv6 address or even an IPv6 prefix yet.
Getting An IPv6 Prefix Over the Established Bearer
At this point in time the mobile has an IPv4 address and an interface identifier it has to combine with a link local prefix to form a link local address from which it can send an IPv6 Router Solicitation message over the established bearer (which, by the way, can also transport IPv4 packets). In our example the source IPv6 address that the mobile uses is the link local address fe80::2:1:c731:f114 and the destination address is the link local ‘all routers’ multicast address fe80::2. The network responds from the link local router multicast address fe80::5 with a Router Advertisement message that contains the IPv6 prefix:
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00) Internet Protocol Version 6, Src: fe80::5 (fe80::5), Dst: ff02::1 (ff02::1) Internet Control Message Protocol v6 Type: Router Advertisement (134) Code: 0 Checksum: 0x760f [correct] Cur hop limit: 0 Flags: 0x40 Router lifetime (s): 65535 Reachable time (ms): 0 Retrans timer (ms): 0 ICMPv6 Option (Prefix information : 2a12:577:9941:f99c::/64)
Selecting an IPv6 Address
At this point the mobile has all pieces in place to create an IPv6 address for itself. At this point it will use the IPv6 prefix it has just received and the interface identifier it has received earlier in the Activate Default Bearer message to create the following IPv6 address:
2a12:577:9941:f99c:0002:0001:c731:f114
3GPP has specified that the mobile can choose any network interface identifier at this point and can change it for privacy purposes at any time.
At this point the mobile has a global IPv6 address and an IPv6 DNS server address so it’s fully configured now to communicate over IPv6. From an overall perspective it is interesting to see how mobile specific 3GPP signaling is mixed with standard IPv6 stateless auto-configuration functionality. That makes the whole process somewhat more complicated but in theory also allows the network to change the IPv6 prefix at any time, e.g. again for privacy purposes.