Contain packets and route advertisements
04Address scope has to be enforced at provider boundaries. Packet filtering and route-advertisement filtering protect different paths.
Separate case: participating providers have a defined hosted-CGN relationship. The stated exception permits the relationship’s shared scope; the rest of the Internet is not opened.
Source for this drawing: RFC 6598 · Read RFC section 4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Ordinary provider boundaries stop shared-address traffic and routing information; a defined hosted-CGN relationship is an explicit exception.
- Packets with a Shared Address Space source or destination MUST NOT cross Service Provider boundaries, and providers MUST filter them on ingress links (§§4,6). Source and destination are both relevant; checking only one direction is incomplete.
- Routing information for Shared Address Space networks MUST NOT propagate across provider boundaries. Providers MUST filter incoming advertisements for those networks (§6). Dropping a packet is not the same operation as rejecting a route advertisement.
- The RFC explicitly excepts hosted CGN services or similar business relationships (§§4,6). The drawn exception is a defined relationship between participating providers, not permission to announce100.64.0.0/10 to the general Internet or forward it through arbitrary peers.
- The examples isolate the shared-address predicate. Actual filtering and routing policy must also handle other special-use addresses, exceptions and network requirements. A packet outside this particular /10 is not automatically accepted by every other policy.
- Shared Address Space does not inherently protect against abuse (§6). Ingress filtering supports scope containment; it does not authenticate users, encrypt traffic or by itself establish that a network is secure.
All gates describe ordinary provider boundaries unless the fourth state explicitly identifies a hosted-CGN business relationship. No DNS, routing or provider configuration is changed by this guide.
Read the RFC section ↗