Summary

  • RFC 9898 is an IETF Informational document. It reviews known IPv6 Neighbor Discovery issues and mitigations; it explicitly introduces no new solution or host-isolation protocol.
  • Its root-cause grouping is operationally useful: multicast, trust in all on-link nodes, and router Neighbor Cache Entries created on demand.
  • L3+L2 isolation is the strongest option in the document’s hierarchy: it can address all inventoried issues, but it needs L2 isolation, a unique prefix per host, and suitable router support or interfaces.
  • L3-only isolation handles most issues with a shared medium, while partial L2 isolation mainly reduces multicast domains and does not automatically remove on-link trust or on-demand router-cache creation.

What the hierarchy means

With L3+L2 isolation, each host is placed in its own subnet and link. The isolated multicast scope and trust boundary remove the three inventoried causes, including router NCEs created on demand. That strength has conditions: per-host prefixes, L2 separation, router support or enough logical interfaces, and a design able to carry forwarding through the router. Host-to-host traffic may consequently concentrate at that router, and host multicast applications such as mDNS can be disrupted.

L3-only isolation gives each host a distinct subnet while retaining a shared medium. It addresses most inventoried issues, but link-local Duplicate Address Detection still has multicast performance and reliability tied to that medium. The on-link security context also remains dependent on the medium and its trust model. RFC 8273 and RFC 9663 provide relevant per-host-prefix and allocation perspectives; they do not turn every deployment into one universal design.

Partial L2 isolation keeps hosts in one subnet while separating multicast domains through proxy or optimization functions. Its stated benefit is lower multicast traffic, especially address resolution. It should not be described as automatically eliminating on-link trust or router NCEs created on demand.

RFC 9898 presents the methods from strongest to weakest as contextual operational guidance, not as a universal normative requirement. Stronger isolation prevents more issues but raises entry requirements; weaker isolation leaves residual issues that may need supplements. Its comparison does not provide deployment prevalence, universal cost figures, throughput results, incident-rate reductions, topology thresholds, interface ceilings, NCE limits, multicast-rate thresholds, or migration timers.

Sources