<?xml version='1.0' encoding='utf-8'?>

<?xml-model href="rfc7991bis.rnc"?>
<!DOCTYPE rfc [
  <!ENTITY nbsp "&#160;">
  <!ENTITY zwsp "&#8203;">
  <!ENTITY nbhy "&#8209;">
  <!ENTITY wj "&#8288;">
]>

<rfc 
  xmlns:xi="http://www.w3.org/2001/XInclude" 
  category="std"
  docName="draft-ietf-6man-ipv6-neighbor-discovery-yang-02"
  ipr="trust200902"
  obsoletes=""
  updates=""
  submissionType="IETF"
  xml:lang="en"
  version="3">

  <front>
    <title abbrev="ND YANG model">YANG Data Model for IPv6 Neighbor Discovery</title>

    <author initials="F" surname="Zhang" fullname="Fan Zhang">
      <organization>China Telecom</organization>
      <address>
        <postal>
          <city>Guangzhou</city>
          <country>China</country>
        </postal>
        <email>zhangf52@chinatelecom.cn</email>
      </address>
    </author>
    <author initials="Y" surname="Zhu" fullname="Yongqing Zhu">
      <organization>China Telecom</organization>
      <address>
        <postal>
          <city>Guangzhou</city>
          <country>China</country>
        </postal>
        <email>zhuyq8@chinatelecom.cn</email>
      </address>
    </author>

    <author initials="B" surname="Wu" fullname="Bo Wu">
      <organization>Huawei</organization>
      <address>
        <postal>
          <country>China</country>
        </postal>
        <email>lana.wubo@huawei.com</email>
      </address>
    </author>

    <author initials="J" surname="Hu" fullname="Jiayuan Hu">
      <organization>China Telecom</organization>
      <address>
        <postal>
          <city>Guangzhou</city>
          <country>China</country>
        </postal>
        <email>hujy5@chinatelecom.cn</email>
      </address>
    </author>
    <date year="2025" />

    <!-- Meta-data Declarations -->

    <area>Internet Area</area>

    <workgroup>6MAN</workgroup>

    <abstract>
      <t>This document defines a YANG data model to configure and manage IPv6 Neighbor Discovery
        (ND) and related functions,
        including IPv6 address resolution, redirect function, proxy Neighbor Advertisement, Neighbor
        Unreachability Detection (NUD), Duplicate
        Address Detection (DAD), and Enhanced Duplicate Address Detection. </t>

    </abstract>
  </front>

  <middle>
    <section anchor="intro" title="Introduction">
      <t>This document defines a YANG data model "ietf-ipv6-nd" to configure and manage IPv6
        Neighbor Discovery (ND) and related functions, including IPv6 address resolution <xref
          target="RFC4861" />, redirect function <xref target="RFC4861" />, proxy Neighbor
        Advertisement <xref target="RFC4861" />, Neighbor Unreachability Detection (NUD) <xref
          target="RFC4861" />, Duplicate Address Detection (DAD) <xref target="RFC4862" />, and
        Enhanced Duplicate Address Detection <xref target="RFC7527" />. </t>

      <t>Basic neighbor management functionality is supported by the "ietf-ip" YANG data model <xref
          target="RFC8344" />, and there is already a draft <xref
          target="I-D.ietf-intarea-arp-yang-model" /> extending the basic ARP YANG functionality to
        cover optional ARP features and related statistics, which applies only to IPv4. Thus, an
        extension for IPv6 is required to maintain the Neighbor Cache entries. </t>

      <t><xref target="RFC4861" /> specifies the Neighbor Discovery protocol for IPv6, and <xref
          target="RFC4862" /> specifies related functions. This document covers IPv6 address
        resolution <xref target="RFC4861" />, redirect function <xref target="RFC4861" />, proxy
        Neighbor Advertisement <xref target="RFC4861" />, NUD <xref target="RFC4861" />, DAD <xref
          target="RFC4862" />, and Enhanced DAD <xref
          target="RFC7527" />. Other function, such as Router and Prefix Discovery <xref
          target="RFC4861" /> are covered by submodule "ietf-ipv6-router-advertisements" in <xref
          target="RFC8349" />, and static neighbor cache entries and Stateless Address
        Autoconfiguration <xref target="RFC4862" /> are covered by module "ietf-ip" in <xref
          target="RFC8344" />. </t>

      <t>The model is based on YANG 1.1 as defined in <xref target="RFC7950" /> and conforms to
        Network Management Datastore Architecture (NMDA) as defined in <xref target="RFC8342" />.</t>

      <section title="Terminology">
        <t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD
          NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be
          interpreted as described in BCP 14 <xref target="RFC2119" /> <xref
            target="RFC8174" /> when, and only when, they appear in all capitals, as shown here.</t>
        <t>The following terms are defined in <xref target="RFC8342" />: </t>
        <ul spacing="normal">
          <li>configuration</li>
          <li>system state</li>
          <li>operational state</li>
        </ul>
        
        <t>The following terms are defined in <xref target="RFC7950" />: </t>
        <ul spacing="normal">
          <li>augment</li>
          <li>container</li>
          <li>data model</li>
          <li>data node</li>
          <li>leaf</li>
          <li>list</li>
          <li>module</li>
          <li>schema tree</li>
        </ul>
        
        <t>The following terms are defined in <xref target="RFC4861" />: </t>
        <ul spacing="normal">
          <li>Neighbor Discovery</li>
          <li>Neighbor Advertisement</li>
          <li>proxy Neighbor Advertisement</li>
          <li>Neighbor Unreachability Detection</li>
        </ul>          
        
        <t>The following term is defined in <xref target="RFC4862" />: </t>
        <ul spacing="normal">
          <li>Duplicate Address Detection</li>
          <li>Stateless Address Autoconfiguration</li>
        </ul>             
        
        <t>The following term is defined in <xref target="RFC7527" />: </t>
        <ul spacing="normal">
          <li>Enhanced Duplicate Address Detection</li>
        </ul>              
        
      </section>

      <section title="Tree Diagrams">
        <t>Tree diagrams used in this document follow the notation defined in <xref
            target="RFC8340" />.</t>
      </section>

    </section>


    <section anchor="design" title="Design of the Data Model">
      <t>The YANG data model for IPv6 ND defines global configurations and augments the "ietf-ip" <xref
          target="RFC8344" /> to provide per-interface configuration. It configures and manages IPv6
        address resolution and redirect functions based on the IPv6 ND protocol, as well as other related
        functions, including proxy Neighbor Advertisement, NUD, DAD, and Enhanced DAD.</t>

      <t>Note that the features related to ICMP Router and Prefix Discovery are outside the scope of
        this module, since they have already been defined in the submodule
        "ietf-ipv6-router-advertisements" <xref target="RFC8349" />. Static neighbor cache
        entries and stateless address autoconfiguration <xref target="RFC4862" /> are also out of
        the scope, as they are covered by "ietf-ip"<xref target="RFC8344" />. </t>

      <section title="IPv6 Address Resolution and Redirect Function">
        <t>The data model augments the "/if:interfaces/if:interface/ip:ipv6" path defined in the
          "ietf-ip" module <xref target="RFC8344" /> for IPv6 ND
          protocol <xref target="RFC4861" />. </t>
        <t>The "dynamic-discovery" leaf enables the dynamic IPv6 address resolution based on ND
          protocol. </t>
        <t>The "ns-interval" leaf defines the interval of retransmitting Neighbor Solicitation
          messages when a node tries to learn the link-layer address of another node.</t>
        <t>For the management of Neighbor Cache entries, the "stale-timeout" leaves define the
          timeout for STALE entries, while the "age" leaf augments the
          "/if:interfaces/if:interface/ip:ipv6/ip:neighbor" path to indicate the elapsed time 
          since the Neighbor Cache entry was last confirmed reachable.</t>
        <t>The "statistics" container defines a collection of interface-related statistics on
          IPv6 ND messages.</t>
        <t>The "redirect" leaf enables the sending and processing of Redirect messages.</t>
      </section>

      <section title="Proxy Neighbor Advertisement">
        <t>The "proxy-na" container augmenting "ietf-ip" <xref target="RFC8344" /> defines the
          configurations of proxy Neighbor Advertisements <xref target="RFC4861" />, which indicate
          that a router is willing to accept packets not explicitly addressed to itself. After
          receiving a Neighbor Solicitation message whose destination address is not its own IPv6
          address, a proxy router replies to the source with a Neighbor Advertisement message carrying
          its own link-layer address and the IPv6 address of the original destination.</t>
        <t>The "inter-vlan-proxy" leaf enables the router to proxy for hosts in the same subnet with
          different VLANs to enable the communication between them.</t>
        <t>The "all-proxy" leaf enables the router to proxy for all hosts, that is, responds
          unconditionally to Neighbor Solicitation messages no matter whether the sources and
          destinations are in the same subnet or not with its own Neighbor Advertisement
          messages, which can attract the traffic to the router itself for centralized control or
          hidding the topology of the network.</t>
      </section>

      <section title="Neighbor Unreachability Detection">
        <t>The "nud" leaf augmenting "ietf-ip" <xref target="RFC8344" /> enables Neighbor
          Unreachability Detection (NUD) <xref target="RFC4861" />, which is used by a node to
          track the reachability of the neighbors to which it sends packets and update the
          state of the related Neighbor Cache entries.</t>
        <t>The "reachable-time" leaf defines the time to confirm a neighbor's reachability for NUD.
          A neighbor's state changes from REACHABLE to STALE when there is no other reachability
          confirmation from the neighbor within the "reachable-time".</t>
        <t>The "ns-interval" leaf also indicates the interval for retransmitting Neighbor
          Solicitation messages used by NUD.</t>
      </section>

      <section title="Duplicate Address Detection">
        <t>The "dup-addr-detect-transmits" leaf, which indicates the number of consecutive Neighbor
          Solicitation messages sent while performing Duplicate Address Detection (DAD) <xref
            target="RFC4862" />, has already been defined in "ietf-ip" <xref target="RFC8344" />. The value of 
          "dup-addr-detect-transmits" can be set to 0 to disable DAD.</t>
        <t>The "ns-interval" leaf also indicates the interval for retransmitting Neighbor
          Solicitation messages during DAD.</t>
        <t>The "enhanced-dad" container augmenting "ietf-ip" <xref target="RFC8344" /> defines the
          configurations for enhanced DAD <xref target="RFC7527" />, which is used to automatically detect the
          looped-back IPv6 ND messages used in DAD. </t>
        <t>The "enhanced-dad-auto-resolve" leaf enables automated action when a duplicate is detected.
          When enabled, a trusted router may log a system management message, drop the received ND message, and
          block the untrusted IPv6 host nodes from which the duplicate NS (DAD) or NA message was received. </t>
      </section>

      <section title="IPv6 Neighbor Discovery Data Model">
        <t>This document defines the YANG module "ietf-ipv6-nd", which has the following structure.</t>

        <figure>
          <artwork><![CDATA[
module: ietf-ipv6-nd
  +--rw nd
     +--rw stale-timeout?   uint32

  augment /if:interfaces/if:interface/ip:ipv6:
    +--rw nd
       +--rw dynamic-discovery?   boolean
       +--rw nud?                 boolean
       +--rw reachable-time?      uint32
       +--rw ns-interval?         uint32
       +--rw stale-timeout?       uint32
       +--rw redirect?            boolean
       +--rw proxy-na
       |  +--rw inter-vlan-proxy?   boolean
       |  +--rw all-proxy?          boolean
       +--rw enhanced-dad
       |  +--rw enable?                      boolean
       |  +--rw enhanced-dad-auto-resolve?   boolean
       +--ro statistics
          +--ro in-ns-pkts?          yang:counter32
          +--ro in-na-pkts?          yang:counter32
          +--ro in-rs-pkts?          yang:counter32
          +--ro in-ra-pkts?          yang:counter32
          +--ro in-redirect-pkts?    yang:counter32
          +--ro out-ns-pkts?         yang:counter32
          +--ro out-na-pkts?         yang:counter32
          +--ro out-rs-pkts?         yang:counter32
          +--ro out-ra-pkts?         yang:counter32
          +--ro out-redirect-pkts?   yang:counter32
  augment /if:interfaces/if:interface/ip:ipv6/ip:neighbor:
    +--ro age?   uint32
        ]]></artwork>
        </figure>

      </section>
    </section>

    <section anchor="yangmodel" title="IPv6 Neighbor Discovery YANG Module">
      <t>This section presents the YANG module of IPv6 Neighbor Discovery defined in this
        document.</t>

      <t>This module imports modules from Common YANG Data Types <xref target="RFC6991" />, A YANG
        Data Model for Interface Management <xref target="RFC8343" />, and A YANG Data Model for IP
        Management <xref target="RFC8344" />.</t>

      <figure>
        <artwork><![CDATA[
<CODE BEGINS> file "ietf-ipv6-nd@2025-10-20.yang"                
module ietf-ipv6-nd {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-ipv6-nd";
  prefix v6nd;

  import ietf-yang-types {
    prefix yang;
    reference
      "RFC 6991: Common YANG Data Types";
  }
  import ietf-interfaces {
    prefix if;
    reference
      "RFC 8343: A Yang Data Model for Interface Management";
  }
  import ietf-ip {
    prefix ip;
    reference
      "RFC 8344: A Yang Data Model for IP Management";
  }

  organization
    "IETF IPv6 Maintenance Working Group (6man)";
  contact
    "WG Web:  <https://datatracker.ietf.org/wg/6man/>
     WG List: <mailto: 6man@ietf.org>

     Author:  Fan Zhang
              <zhangf52@chinatelecom.cn>
     Author:  Yongqing Zhu
              <zhuyq8@chinatelecom.cn>
     Author:  Bo Wu
              <lana.wubo@huawei.com>
     Author:  Jiayuan Hu
              <hujy5@chinatelecom.cn>";
  description
    "This YANG module defines a YANG data model to configure and manage
     IPv6 Neighbor Discovery (ND) and related functions, including
     IPv6 address resolution, redirect, proxy Neighbor
     Advertisement, Neighbor Unreachability Detection (NUD), Duplicate
     Address Detection (DAD), and Enhanced DAD.

     The model is based on YANG 1.1 as defined in RFC 7950 and
     conforms to Network Management Datastore Architecture (NMDA)
     as defined in RFC 8342.

     Copyright (c) 2025 IETF Trust and the persons identified as
     authors of the code.  All rights reserved.

     Redistribution and use in source and binary forms, with or
     without modification, is permitted pursuant to, and subject to
     the license terms contained in, the Revised BSD License set
     forth in Section 4.c of the IETF Trust's Legal Provisions
     Relating to IETF Documents
     (https://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC XXXX
     (https://www.rfc-editor.org/info/rfcXXXX); see the RFC itself
     for full legal notices.

     The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
     NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
     'MAY', and 'OPTIONAL' in this document are to be interpreted as
     described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
     they appear in all capitals, as shown here.";
  reference
    "RFC4861: Neighbor Discovery for IP version 6 (IPv6)
     RFC4862: IPv6 Stateless Address Autoconfiguration
     RFC7527: Enhanced Duplicate Address Detection";

  revision 2025-10-20 {
    description
      "Init revision";
    reference
      "RFC XXXX: YANG Data Model for IPv6 Neighbor Discovery";
  }

  /* Data nodes */

  container nd {
    description
      "Global parameters for IPv6 ND.";
    leaf stale-timeout {
      type uint32;
      units "second";
      description
        "The global timeout for Neighbor Cache entry in the STALE
         state.";
      reference
        "RFC4861: Neighbor Discovery for IP version 6 (IPv6)
                  Section 5.3";
    }
  }

  augment "/if:interfaces/if:interface/ip:ipv6" {
    description
      "Augments interface configuration and state data with
       parameters of IPv6 ND.";
    container nd {
      description
        "Parameters of IPv6 ND.";
      leaf dynamic-discovery {
        type boolean;
        default "true";
        description
          "Controls whether dynamic link-layer address resolution
           for IPv6 on the interface is enabled or disabled.
            true -  dynamic link-layer address resolution based on
                    IPv6 ND is enabled,
            false - dynamic link-layer address resolution based on
                    IPv6 ND is disabled.";
        reference
          "RFC4861: Neighbor Discovery for IP version 6 (IPv6)
                    Section 7.2";
      }
      leaf nud {
        type boolean;
        default "true";
        description
          "Controls whether Neighbor Unreachability Detection (NUD)
           on the interface is enabled or disabled.
            true -  NUD is enabled,
            false - NUD is disabled.";
        reference
          "RFC4861: Neighbor Discovery for IP version 6 (IPv6)
                    Section 7.3";
      }
      leaf reachable-time {
        type uint32 {
          range "0..3600000";
        }
        units "millisecond";
        description
          "The time to confirm a neighbor's reachability for NUD.";
        reference
          "RFC4861: Neighbor Discovery for IP version 6 (IPv6)
                    - ReachableTime";
      }
      leaf ns-interval {
        type uint32;
        units "milliseconds";
        description
          "The interval of retransmitting Neighbor Solicitations to a
           neighbor for address resolution, NUD, or DAD.";
        reference
          "RFC4861: Neighbor Discovery for IP version 6 (IPv6)
                    Section 7.3.3";
      }
      leaf stale-timeout {
        type uint32;
        units "second";
        description
          "The timeout for Neighbor Cache entry in the STALE state on
           the interface.";
        reference
          "RFC4861: Neighbor Discovery for IP version 6 (IPv6)
                    Section 5.3";
      }
      leaf redirect {
        type boolean;
        default "false";
        description
          "Controls whether sending of ICMP Redirect messages
           on the interface is enabled or disabled.
            true -  Sending of ICMP Redirect messages is enabled,
            false - Sending of ICMP Redirect messages is disabled.";
        reference
          "RFC4861: Neighbor Discovery for IP version 6 (IPv6)
                    Section 8";
      }
      container proxy-na {
        description
          "Parameters of proxy Neighbor Advertisements.";
        leaf inter-vlan-proxy {
          type boolean;
          default "false";
          description
            "Controls whether the router proxies for hosts in the
             same subnet with different VLANs";
        }
        leaf all-proxy {
          type boolean;
          default "false";
          description
            "Controls whether the router proxies for all hosts,
             that is, responds unconditionally to Neighbor
             Solicitation with its own Neighbor Advertisement.";
        }
        reference
          "RFC4861: Neighbor Discovery for IP version 6 (IPv6)
                    Section 7.2.8";
      }
      container enhanced-dad {
        description
          "Parameters of Enhanced DAD algorithm.";
        leaf enable {
          type boolean;
          default "false";
          description
            "Controls whether Enhanced DAD algorithm is enabled or
             disabled.";
        }
        leaf enhanced-dad-auto-resolve {
          type boolean;
          default "false";
          description
            "Controls whether the automated action is taken when
             detecting duplicates. A trusted router can log a system
             management message, drop the received ND message, and
             block the untrusted IPv6 host nodes from which the
             duplicate NS(DAD) or NA message was received.";
        }
        reference
          "RFC7527: Enhanced Duplicate Address Detection";
      }
      container statistics {
        config false;
        description
          "A collection of interface-related statistics about IPv6
           ND messages.";
        leaf in-ns-pkts {
          type yang:counter32;
          description
            "The number of received Neighbor Solicitation packets.";
        }
        leaf in-na-pkts {
          type yang:counter32;
          description
            "The number of received Neighbor Advertisement packets.";
        }
        leaf in-rs-pkts {
          type yang:counter32;
          description
            "The number of received Router Solicitation packets.";
        }
        leaf in-ra-pkts {
          type yang:counter32;
          description
            "The number of received Router Advertisement packets.";
        }
        leaf in-redirect-pkts {
          type yang:counter32;
          description
            "The number of received Redirect packets.";
        }
        leaf out-ns-pkts {
          type yang:counter32;
          description
            "The number of sent Neighbor Solicitation packets.";
        }
        leaf out-na-pkts {
          type yang:counter32;
          description
            "The number of sent Neighbor Advertisement packets.";
        }
        leaf out-rs-pkts {
          type yang:counter32;
          description
            "The number of sent Router Solicitation packets.";
        }
        leaf out-ra-pkts {
          type yang:counter32;
          description
            "The number of sent Router Advertisement packets.";
        }
        leaf out-redirect-pkts {
          type yang:counter32;
          description
            "The number of sent Redirect packets.";
        }
      }
    }
  }

  augment "/if:interfaces/if:interface/ip:ipv6/ip:neighbor" {
    description
      "Augments IPv6 neighbor list with parameters of IPv6 address
       resolution based on IPv6 ND.";
    leaf age {
      type uint32;
      units "milliseconds";
      config false;
      description
        "The time that has passed since receipt of the last
         reachability confirmation for the neighbor.";
      reference
        "RFC4861: Neighbor Discovery for IP version 6 (IPv6)
                  Section 5.1";
    }
  }
}

<CODE ENDS>                    
]]></artwork>
      </figure>
    </section>

    <section title="IANA Considerations">
      <t>This document registers a URI in the IETF XML registry <xref target="RFC3688" />. Following
        the format in <xref target="RFC3688" />, the following registration is requested to be made:</t>

      <figure>
        <artwork><![CDATA[
    URI: urn:ietf:params:xml:ns:yang:ietf-ipv6-nd
    Registrant Contact: The IESG.
    XML: N/A, the requested URI is an XML namespace.
                ]]></artwork>
      </figure>

      <t>This document registers a YANG module in the YANG Module Names registry <xref
          target="RFC6020" />.</t>

      <figure>
        <artwork><![CDATA[
    name: ietf-ipv6-nd
    namespace: urn:ietf:params:xml:ns:yang:ietf-ipv6-nd
    prefix: v6nd
    reference: RFC XXXX
                ]]></artwork>
      </figure>
    </section>

    <section anchor="security" title="Security Considerations">
      <t>The YANG module specified in this document defines a schema for data that is designed to be
        accessed via network management protocols such as NETCONF <xref
          target="RFC6241" /> or RESTCONF <xref target="RFC8040" /> . The lowest NETCONF layer is
        the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell
        (SSH) <xref
          target="RFC6242" />. The lowest RESTCONF layer is HTTPS, and the mandatory-to-implement
        secure transport is TLS <xref
          target="RFC8446" />.</t>

      <t>The NETCONF Access Control Model (NACM) <xref target="RFC8341" /> provides the means to
        restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of all
        available NETCONF or RESTCONF protocol operations and content.</t>

      <t>There are a number of data nodes defined in this YANG module that are
        writable/creatable/deletable (i.e., config true, which is the default).
        These data nodes may be considered sensitive or vulnerable in some
        network environments. Write operations (e.g., edit-config) to these data
        nodes without proper protection can have a negative effect on network
        operations. These are the subtrees and data nodes and their
        sensitivity/vulnerability:</t>

      <ul spacing="normal">
        <li>/if:interfaces/if:interface/ip:ipv6/ipv6-nd:nd/ipv6-nd:dynamic-discovery -
          This leaf is used to enable IPv6 address resolution, which could allow traffic to be
          hijacked.</li>
        <li>/if:interfaces/if:interface/ip:ipv6/ipv6-nd:nd/ipv6-nd:proxy-na - This
          subtree is used to enable proxy Neighbor Advertisement on an interface, which could allow
          spoofing traffic to be injected.</li>
        <li>/if:interfaces/if:interface/ip:ipv6/ipv6-nd:nd/ipv6-nd:nud - This leaf could
          be used to disable NUD on an interface, which could lead to delays in Neighbor Cache
          updates and cause packets forwarding to unreachable nodes.</li>
        <li>/if:interfaces/if:interface/ip:ipv6/ipv6-nd:nd/ipv6-nd:reachable-time - This
          leaf is used to consider a neighbor reachable since the last confirmation of reachability,
          which could be set to big values to prolong the effect of spoofing Neighbor Cache entries
          or small values to cause unnecessary frequent NUDs.</li>
        <li>/if:interfaces/if:interface/ip:ipv6/ipv6-nd:nd/ipv6-nd:ns-interval - This
          leaf is used to set the interval of retransmitting Neighbor Solicitations, which could
          allow DoS attacks.</li>
        <li>/ipv6-nd:nd/ipv6-nd:stale-timeout and
          /if:interfaces/if:interface/ip:ipv6/ipv6-nd:nd/ipv6-nd:stale-timeout - These
          leaves are used to set the timeout for Neighbor Cache entry in the STALE state,
          which could allow the consumption of cache.</li>
        </ul>

      <t>Some of the readable data nodes in the ietf-ipv6-nd module may be considered
        sensitive or vulnerable in some network environments. It is thus important to
        control read access (e.g., via get, get-config, or notification) to these data
        nodes.</t>
    </section>

    <section anchor="ack" title="Acknowledgments">
      <t>The authors would like to thank Bin Han, Acee Lindem, Jen Linkova, Éric Vyncke, and many others for their helpful comments and suggestions.</t>
    </section>

  </middle>

  <back>

    <references title="Normative References">
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.3688.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.4861.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.4862.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.4941.xml" />      
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.6020.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.6241.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.6242.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.6991.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.7527.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.7950.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.8040.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.8174.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.8341.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.8342.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.8343.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.8344.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.8349.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.8446.xml" />
      <xi:include
        href="https://bib.ietf.org/public/rfc/bibxml3/reference.I-D.ietf-intarea-arp-yang-model.xml" />

    </references>

    <references title="Informative References">
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.8340.xml" />
      <xi:include href="http://xml.resource.org/public/rfc/bibxml/reference.RFC.8792.xml" />

    </references>

    <!-- appendix -->
    <section anchor="datamodel" title="Data Model Examples">
      <section anchor="configStatic" title="Configured Static IPv6 Neighbor Cache Entry">
        <t>This example illustrates the manual configuration for a Neighbor Cache entry of
          interface eth0 for
          peer 2001:db8::2 with link-layer address 00:00:5E:00:53:AB statically. </t>
        <t>Note: '\' line wrapping per <xref target="RFC8792" format="default" />. </t>
        <figure>
          <artwork> <![CDATA[
<?xml version="1.0" encoding="utf-8"?>
<interfaces \
  xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces" \
  xmlns:ianaift="urn:ietf:params:xml:ns:yang:iana-if-type">
  <interface>
  <name>eth0</name>
  <type>ianaift:ethernetCsmacd</type>
  <!-- other parameters from ietf-interfaces omitted -->

  <ipv6 xmlns="urn:ietf:params:xml:ns:yang:ietf-ip">
    <!-- ipv6 address configuration parameters omitted -->
    <neighbor>
    <ip>2001:db8::2</ip>
    <link-layer-address>00:00:5E:00:53:AB</link-layer-address>
    </neighbor>
  </ipv6>
  </interface>
</interfaces>
                    ]]></artwork>
        </figure>
      </section>
      <section anchor="configProxy"
        title="Configuration of Proxy Neighbor Advertisement, NUD, and DAD">
        <t>This example illustrates the configuration of enabling proxy Neighbor Advertisement, NUD,
          and DAD with setting the "dup-addr-detect-transmits" leaf as 1, the "reachable-time" leaf
          as 30000 milliseconds, and the "ns-interval" leaf as 1000 milliseconds.</t>
        <t>Note: '\' line wrapping per <xref target="RFC8792" format="default" />. </t>
        <figure>
          <artwork><![CDATA[
<?xml version="1.0" encoding="utf-8"?>
<interfaces \
  xmlns="urn:ietf:params:xml:ns:yang:ietf-interfaces" \
  xmlns:ianaift="urn:ietf:params:xml:ns:yang:iana-if-type">
  <interface>
  <name>eth0</name>
  <type>ianaift:ethernetCsmacd</type>
  <!-- other parameters from ietf-interfaces omitted -->

    <ipv6 xmlns="urn:ietf:params:xml:ns:yang:ietf-ip">
      <dup-addr-detect-transmits>1</dup-addr-detect-transmits>
      <!-- ipv6 address configuration parameters omitted -->

      <nd xmlns="urn:ietf:params:xml:ns:yang:ietf-ipv6-nd">
        <dynamic-discovery>true</dynamic-discovery>
        <nud>true</nud>
        <reachable-time>30000</reachable-time>
        <ns-interval>1000</ns-interval>
        <stale-timeout>1200</stale-timeout>
        <proxy-na>
          <inter-vlan-proxy>true</inter-vlan-proxy>
        </proxy-na>
      </nd>
    </ipv6>
  </interface>
</interfaces>
                    ]]></artwork>
        </figure>
      </section>
    </section>


    <section anchor="Coverage" title="Coverage of IPv6 ND Functions in YANG Modules">
      <t>This appendix analyzes the functional elements related to the IPv6 ND protocol and identifies whether they are covered by existing IETF YANG modules or defined in this document.</t>
      <t>The table below maps the relevant RFCs, functions or parameters, the corresponding YANG modules, and their specific data paths. The functions are defined in <xref target="RFC4861" /> (Neighbor Discovery for IP version 6 (IPv6)), <xref target="RFC4862" /> (IPv6 Stateless Address Autoconfiguration), and other RFC extending IPv6 ND functions. The parameters are defined in Section 6.2.1 and 6.3.2 of <xref target="RFC4861" />, Section 5.1 of <xref target="RFC4862" />, and Section 3.3 of <xref target="RFC4941" />.</t>

      <table> 
        <name>Coverage of IPv6 ND Functions in YANG Modules</name>
        <thead> 
        <!-- A table header is optional -->
          <tr>
            <th>RFC (Sec)</th>
            <th>Function/Parameter</th>
            <th>Covered by</th>
            <th>Path</th>
          </tr>
        </thead>
        <tbody>
          <!-- A table body is required -->
          <tr>
            <td>4861 s5.1</td>
            <td>Neighbor Cache</td>
            <td>ietf-ip</td>
            <td>/if:interfaces/if:interface/ip:ipv6/ip:neighbor</td>
          </tr>
          <tr>
            <td>4862 s5.1</td>
            <td>Prefix List (AdvPrefixList)</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>/if:interfaces/if:interface/ip:ipv6/v6ur:prefix-list</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>IsRouter</td>
            <td>ietf-ip</td>
            <td>/if:interfaces/if:interface/ip:ipv6/ip:forwarding</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvSendAdvertisements</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6ur:ipv6-router-advertisements</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>MaxRtrAdvInterval</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6ur:max-rtr-adv-interval</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>MinRtrAdvInterval</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6ur:min-rtr-adv-interval</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvManagedFlag</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>/if:interfaces/if:interface/ip:ipv6/v6ur:managed-flag</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvOtherConfigFlag</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>/if:interfaces/if:interface/ip:ipv6/v6ur:other-config-flag</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvLinkMTU</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>/if:interfaces/if:interface/ip:ipv6/v6ur:link-mtu</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvReachableTime (for RA)</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>/if:interfaces/if:interface/ip:ipv6/v6ur:reachable-time</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvRetransTimer</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>/if:interfaces/if:interface/ip:ipv6/v6ur:retrans-timer</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvCurHopLimit</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>/if:interfaces/if:interface/ip:ipv6/v6ur:cur-hop-limit</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvDefaultLifetime</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>/if:interfaces/if:interface/ip:ipv6/v6ur:default-lifetime</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvPrefixList /AdvValidLifetime</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6ur:prefix-list/v6ur:prefix/v6ur:control-adv-prefixes/v6ur:advertise/v6ur:valid-lifetime</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvPrefixList /AdvOnLinkFlag</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6ur:prefix-list/v6ur:prefix/v6ur:control-adv-prefixes/v6ur:advertise/v6ur:on-link-flag</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvPrefixList/ AdvPreferredLifetime</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6ur:prefix-list/v6ur:prefix/v6ur:control-adv-prefixes/v6ur:advertise/v6ur:preferred-lifetime</td>
          </tr>
          <tr>
            <td>4861 s6.2.1</td>
            <td>AdvPrefixList/ AdvAutonomousFlag</td>
            <td>ietf-ipv6-router-advertisements</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6ur:prefix-list/v6ur:prefix/v6ur:control-adv-prefixes/v6ur:advertise/v6ur:autonomous-flag</td>
          </tr>
          <tr>
            <td>4861 s6.3.2</td>
            <td>ReachableTime(for NUD)</td>
            <td>ietf-ipv6-nd</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:reachable-time</td>
          </tr>
          <tr>
            <td>4861 s6.3.2 /4862 s5.1</td>
            <td>RetransTimer(for NS)</td>
            <td>ietf-ipv6-nd</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:ns-interval</td>
          </tr>
          <tr>
            <td>4861 s6.3.2</td>
            <td>CurHopLimit(for Node)</td>
            <td>(reuse AdvCurHopLimit)</td>
            <td> </td>
          </tr>
          <tr>
            <td>4861 s5.3</td>
            <td>Timeout for stale information</td>
            <td>ietf-ipv6-nd</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:stale-timeout</td>
          </tr>
          <tr>
            <td>4861 s7.2</td>
            <td>Address Resolution</td>
            <td>ietf-ipv6-nd</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:dynamic-discovery</td>
          </tr>
          <tr>
            <td>4861 s7.2</td>
            <td>Neighbor Unreachability Detection</td>
            <td>ietf-ipv6-nd</td>
            <td>/if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:nud</td>
          </tr>
          <tr>
            <td>4861 s7.2.8</td>
            <td>Proxy Neighbor Advertisements</td>
            <td>ietf-ipv6-nd</td>
            <td>/if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:proxy-na</td>
          </tr>
          <tr>
            <td>4861 s8</td>
            <td>Redirect</td>
            <td>ietf-ipv6-nd</td>
            <td>/if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:redirect</td>
          </tr>
          <tr>
            <td>4862 s5.1</td>
            <td>DupAddrDetectTransmits</td>
            <td>ietf-ip</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/ip:dup-addr-detect-transmits</td>
          </tr>
          <tr>
            <td>4862 s5.5</td>
            <td>Creation of Global Addresses</td>
            <td>ietf-ip</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/ip:autoconf/ip:create-global-addresses</td>
          </tr>
          <tr>
            <td>4941</td>
            <td>Creation of Temporary Addresses</td>
            <td>ietf-ip</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/ip:autoconf/ip:create-temporary-addresses</td>
          </tr>
          <tr>
            <td>4941</td>
            <td>TEMP_VALID_LIFETIME</td>
            <td>ietf-ip</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/ip:autoconf/ip:temporary-valid-lifetime</td>
          </tr>
          <tr>
            <td>4941</td>
            <td>TEMP_PREFERRED_ LIFETIME</td>
            <td>ietf-ip</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/ip:autoconf/ip:temporary-preferred-lifetime</td>
          </tr>
          <tr>
            <td>7527</td>
            <td>Enhanced Duplicate Address Detection</td>
            <td>ietf-ipv6-nd</td>
            <td>
              /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:enhanced-dad</td>
          </tr>
        </tbody>
      </table>
          
    </section>

    <!-- contributors -->
    <section numbered="false" toc="include" removeInRFC="false" anchor="contributors"
      title="Contributors">
      <contact fullname="Bin Han">
        <organization showOnFrontPage="true">Huawei</organization>
        <address>
          <postal>
            <country>China</country>
          </postal>
          <email>hanbin3@huawei.com</email>
        </address>
      </contact>
    </section>

  </back>
</rfc>