]> YANG Data Model for IPv6 Neighbor Discovery China Telecom
Guangzhou China zhangf52@chinatelecom.cn
China Telecom
Guangzhou China zhuyq8@chinatelecom.cn
Huawei
China lana.wubo@huawei.com
China Telecom
Guangzhou China hujy5@chinatelecom.cn
Internet Area 6MAN This document defines a YANG data model to configure and manage IPv6 Neighbor Discovery (ND) and related functions, including IPv6 address resolution, redirect function, proxy Neighbor Advertisement, Neighbor Unreachability Detection (NUD), Duplicate Address Detection (DAD), and Enhanced Duplicate Address Detection.
This document defines a YANG data model "ietf-ipv6-nd" to configure and manage IPv6 Neighbor Discovery (ND) and related functions, including IPv6 address resolution , redirect function , proxy Neighbor Advertisement , Neighbor Unreachability Detection (NUD) , Duplicate Address Detection (DAD) , and Enhanced Duplicate Address Detection . Basic neighbor management functionality is supported by the "ietf-ip" YANG data model , and there is already a draft extending the basic ARP YANG functionality to cover optional ARP features and related statistics, which applies only to IPv4. Thus, an extension for IPv6 is required to maintain the IPv6 Neighbor Cache entries. specifies the Neighbor Discovery protocol for IPv6, and specifies related functions. This document covers IPv6 address resolution , redirect function , proxy Neighbor Advertisement , NUD , DAD , and Enhanced DAD . Other functions, such as Router and Prefix Discovery are covered by submodule "ietf-ipv6-router-advertisements" in , and static neighbor cache entries and Stateless Address Autoconfiguration are covered by module "ietf-ip" in . Neighbor Discovery Optimization for 6LoWPANs and other related extensions, such as those specified in , , and , are out of scope of this document.
The following terms are defined in :
  • configuration
  • system state
  • operational state
The following terms are defined in :
  • augment
  • container
  • data model
  • data node
  • leaf
  • list
  • module
  • schema tree
The following terms are defined in :
  • Neighbor Discovery
  • Neighbor Advertisement
  • proxy Neighbor Advertisement
  • Neighbor Unreachability Detection
The following term is defined in :
  • Duplicate Address Detection
  • Stateless Address Autoconfiguration
The following term is defined in :
  • Enhanced Duplicate Address Detection
Tree diagrams used in this document follow the notation defined in .
The YANG data model for IPv6 ND augments the "ietf-ip" to provide per-interface configuration and management of IPv6 address resolution and redirect functions based on the IPv6 ND protocol, as well as other related functions, including proxy Neighbor Advertisement, NUD, DAD, and Enhanced DAD. Note that the features related to ICMP Router and Prefix Discovery are outside the scope of this module, since they have already been defined in the submodule "ietf-ipv6-router-advertisements" . Static neighbor cache entries and stateless address autoconfiguration are also out of scope, as they are covered by "ietf-ip".
The data model augments the "/if:interfaces/if:interface/ip:ipv6" path defined in the "ietf-ip" module for IPv6 ND protocol . The "retrans-timer" leaf defines the interval of retransmitting Neighbor Solicitation messages when a node tries to learn the link-layer address of another node. The "redirect" leaf enables the sending of Redirect messages. The "statistics" container defines a collection of per-interface operational statistics for each type of IPv6 ND messages.
The "reachable-time" leaf defines the time to confirm a neighbor's reachability for NUD. A neighbor's state changes from REACHABLE to STALE when there is no other reachability confirmation from the neighbor within the "reachable-time". The "retrans-timer" leaf also indicates the interval for retransmitting Neighbor Solicitation messages used by NUD.
The "proxy-na" leaf augmenting "ietf-ip" defines the configurations of proxy Neighbor Advertisements , which indicate that a router is willing to accept packets not explicitly addressed to itself. After receiving a Neighbor Solicitation message whose destination address is not its own IPv6 address, a proxy router replies to the source with a Neighbor Advertisement message carrying its own link-layer address and the IPv6 address of the original destination.
The "dup-addr-detect-transmits" leaf, as defined in "ietf-ip" , indicates the number of consecutive Neighbor Solicitation messages sent while performing Duplicate Address Detection (DAD) . The value of "dup-addr-detect-transmits" can be set to 0 to disable DAD. The "retrans-timer" leaf also indicates the interval for retransmitting Neighbor Solicitation messages during DAD. The "enhanced-dad" container augmenting "ietf-ip" defines the configurations for enhanced DAD , which is used to automatically detect the looped-back IPv6 ND messages used in DAD. The "auto-resolve" leaf enables automated action when a duplicate is detected. When enabled, a trusted router may log a system management message, drop the received ND message, and block the untrusted IPv6 host nodes from which the duplicate NS (DAD) or NA message was received.
This document defines the YANG module "ietf-ipv6-nd", which has the following structure.
This section presents the YANG module of IPv6 Neighbor Discovery defined in this document. This module imports modules from Common YANG Data Types , A YANG Data Model for Interface Management , and A YANG Data Model for IP Management . WG List: 6MAN Author: Fan Zhang Author: Yongqing Zhu Author: Bo Wu Author: Jiayuan Hu "; description "This YANG module defines a YANG data model to configure and manage IPv6 Neighbor Discovery (ND) and related functions, including IPv6 address resolution, redirect, proxy Neighbor Advertisement, Neighbor Unreachability Detection (NUD), Duplicate Address Detection (DAD), and Enhanced DAD. Copyright (c) 2026 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). All revisions of IETF and IANA published modules can be found at the YANG Parameters registry group (https://www.iana.org/assignments/yang-parameters). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices."; // RFC Ed: replace '2026-04-20' with the module publication date // the format is (YYYY-MM-DD) // replace XXXX with actual RFC number and remove // this note revision 2026-04-20 { description "Initial version."; reference "RFC XXXX: YANG Data Model for IPv6 Neighbor Discovery"; } /* Groupings */ grouping nd-basic-statistics { description "Grouping for basic statistics for IPv6 ND messages."; leaf in-pkts { type yang:counter64; description "The total number of packets received."; } leaf out-pkts { type yang:counter64; description "The total number of packets transmitted."; } leaf drop-pkts { type yang:counter64; description "The total number of packets discarded."; } } grouping nd-unicast-multicast-statistics { description "Grouping for statistics for IPv6 ND messages categorized by unicast and multicast."; leaf in-unicast-pkts { type yang:counter64; description "The total number of packets received with the destination address as a unicast address."; } leaf in-multicast-pkts { type yang:counter64; description "The total number of packets received with the destination address as a multicast address."; } leaf out-unicast-pkts { type yang:counter64; description "The total number of packets transmitted with the destination address as a unicast address."; } leaf out-multicast-pkts { type yang:counter64; description "The total number of packets transmitted with the destination address as a multicast address."; } } grouping nd-drop-statistics { description "Grouping for statistics for IPv6 ND messages discarded by reason."; leaf drop-bad-code-pkts { type yang:counter64; description "The total number of packets discarded due to invalid code."; } leaf drop-bad-hoplimit-pkts { type yang:counter64; description "The total number of packets discarded due to invalid hop limits."; } leaf drop-bad-len-pkts { type yang:counter64; description "The total number of packets discarded due to invalid length."; } leaf drop-bad-option-pkts { type yang:counter64; description "The total number of packets discarded due to invalid option."; } leaf drop-checksum-err-pkts { type yang:counter64; description "The total number of packets discarded due to checksum errors."; } leaf drop-fragmented-pkts { type yang:counter64; description "The total number of packets discarded due to fragmentation."; } } /* Data nodes */ augment "/if:interfaces/if:interface/ip:ipv6" { description "Augments interface configuration and state data with parameters of IPv6 ND."; container nd { description "Parameters of IPv6 ND."; leaf reachable-time { type uint32 { range "1..3600000"; } units "milliseconds"; default "30000"; description "The time to confirm a neighbor's reachability for NUD."; reference "RFC4861: Neighbor Discovery for IP version 6 (IPv6) Section 6.3.2 - BaseReachableTime"; } leaf retrans-timer { type uint32 { range "1..max"; } units "milliseconds"; default "1000"; description "The interval of retransmitting Neighbor Solicitations to a neighbor for address resolution, NUD, or DAD."; reference "RFC4861: Neighbor Discovery for IP version 6 (IPv6) Section 6.3.2 - RetransTimer"; } leaf redirect { type boolean; default "false"; description "Controls whether sending of ICMP Redirect messages on the interface is enabled or disabled. true - Sending of ICMP Redirect messages is enabled, false - Sending of ICMP Redirect messages is disabled."; reference "RFC4861: Neighbor Discovery for IP version 6 (IPv6) Section 8"; } leaf proxy-na { type boolean; default "false"; description "Controls whether proxies for one or more other nodes by sending proxy Neighbor Advertisement. true - Proxy NA is enabled, false - Proxy NA is disabled."; reference "RFC4861: Neighbor Discovery for IP version 6 (IPv6) Section 7.2.8"; } container enhanced-dad { description "Parameters of Enhanced DAD algorithm."; leaf enable { type boolean; default "false"; description "Controls whether Enhanced DAD algorithm is enabled or disabled."; reference "RFC7527: Enhanced Duplicate Address Detection Section 4"; } leaf auto-resolve { when "../enable = 'true'"; type boolean; default "false"; description "Controls whether the automated action is taken when detecting duplicates. A trusted router can log a system management message, drop the received ND message, and block the untrusted IPv6 host nodes from which the duplicate NS(DAD) or NA message was received."; reference "RFC7527: Enhanced Duplicate Address Detection Section 5"; } reference "RFC7527: Enhanced Duplicate Address Detection"; } container statistics { config false; description "A collection of interface-related statistics about IPv6 ND messages."; container ns-stats { description "Statistics for Neighbor Solicitation packets."; uses nd-basic-statistics; uses nd-unicast-multicast-statistics; uses nd-drop-statistics; leaf out-nud-pkts { type yang:counter64; description "The total number of NS packets transmitted for NUD."; } } container na-stats { description "Statistics for Neighbor Advertisement packets."; uses nd-basic-statistics; uses nd-unicast-multicast-statistics; uses nd-drop-statistics; leaf in-solicited-pkts { type yang:counter64; description "The total number of solicited NA packets received."; } leaf in-unsolicited-pkts { type yang:counter64; description "The total number of unsolicited NA packets received."; } leaf in-override-pkts { type yang:counter64; description "The total number of override NA packets received."; } leaf in-nonoverride-pkts { type yang:counter64; description "The total number of non-override NA packets received."; } leaf out-solicited-pkts { type yang:counter64; description "The total number of solicited NA packets transmitted."; } leaf out-unsolicited-pkts { type yang:counter64; description "The total number of unsolicited NA packets transmitted."; } leaf out-override-pkts { type yang:counter64; description "The total number of override NA packets transmitted."; } leaf out-nonoverride-pkts { type yang:counter64; description "The total number of non-override NA packets transmitted."; } } container rs-stats { description "Statistics for Router Solicitation packets."; uses nd-basic-statistics; uses nd-unicast-multicast-statistics; uses nd-drop-statistics; } container ra-stats { description "Statistics for Router Advertisement packets."; uses nd-basic-statistics; uses nd-unicast-multicast-statistics; uses nd-drop-statistics; } container redirect-stats { description "Statistics for Redirect packets."; uses nd-basic-statistics; uses nd-drop-statistics; } } } } augment "/if:interfaces/if:interface/ip:ipv6/ip:neighbor" { description "Augments IPv6 neighbor list with parameters of IPv6 address resolution based on IPv6 ND."; leaf age { when "../ip:origin = 'dynamic'"; type uint32; units "seconds"; config false; description "The time that has passed since receipt of the last reachability confirmation for the neighbor. Ignored when the neighbor entry is static."; reference "RFC4861: Neighbor Discovery for IP version 6 (IPv6) Section 7.3.3"; } } } ]]>
IANA is requested to register the following URI in the "ns" registry within the "IETF XML Registry" group : IANA is requested to register the following YANG module in the "YANG Module Names" registry within the "YANG Parameters" registry group.
This section is modeled after the template described in Section 3.7.1 of . The "ietf-ipv6-nd" YANG module defines a data model that is designed to be accessed via YANG-based management protocols, such as the Network Configuration Protocol (NETCONF) and RESTCONF . These YANG-based management protocols (1) have to use a secure transport layer (e.g., Secure Shell (SSH) , TLS , and QUIC ) and (2) have to use mutual authentication. The Network Configuration Access Control Model (NACM) provides the means to restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. There are a number of data nodes defined in this YANG module that are writable/creatable/deletable (i.e., "config true", which is the default). All writable data nodes are likely to be sensitive or vulnerable in some network environments. Write operations (e.g., edit-config) and delete operations to these data nodes without proper protection or authentication can have a negative effect on network operations. The following subtrees and data nodes have particular sensitivities/vulnerabilities: * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:reachable-time This leaf is used to consider a neighbor reachable since the last confirmation of reachability, which could be set to big values to prolong the effect of spoofing Neighbor Cache entries or small values to cause unnecessary frequent NUDs. * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:retrans-timer This leaf is used to set the interval of retransmitting Neighbor Solicitations, which could allow DoS attacks. * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:redirect This leaf is used to enable the sending of Redirect messages on an interface, which could allow traffic to be misdirected, potentially resulting in traffic hijacking, man-in-the-middle attacks, or DoS attacks. * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:proxy-na This leaf is used to enable proxy Neighbor Advertisement on an interface, which could allow spoofing traffic to be injected. Some of the readable data nodes in this YANG module may be considered sensitive or vulnerable in some network environments. It is thus important to control read access (e.g., via get, get-config, or notification) to these data nodes. Specifically, the following subtrees and data nodes have particular sensitivities/ vulnerabilities: * /if:interfaces/if:interface/ip:ipv6/ip:neighbor/v6nd:age Unauthorized access to this node may disclose information about IPv6 neighbor reachability and activity patterns on the network. * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:redirect * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:proxy-na * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:enhanced-dad Unauthorized access to these nodes may disclose device behavior and security-related configuration of IPv6 Neighbor Discovery functions.
The authors would like to thank Bin Han, Acee Lindem, Jen Linkova, Éric Vyncke, Changwang Lin, and many others for their helpful comments and suggestions. Thanks to Ebben Aries for the review and comments.
References
This example illustrates the configuration of enabling proxy Neighbor Advertisement, Redirect, NUD, DAD, and enhanced DAD on interface eth0 with setting the "dup-addr-detect-transmits" leaf as 2, the "reachable-time" leaf as 40000 milliseconds, and the "retrans-timer" leaf as 2000 milliseconds, using the ietf-interfaces module , the ietf-ip module , and the IPv6 ND module. eth0 ianaift:ethernetCsmacd 2 40000 2000 true true true true ]]> The following is the same example using JSON format.
This appendix summarizes the functional elements related to the IPv6 ND protocol and identifies whether they are covered by existing IETF YANG modules or defined in this document. The table below maps the relevant RFCs, functions or parameters, the corresponding YANG modules, and their specific data paths. The functions are defined in (Neighbor Discovery for IP version 6 (IPv6)), (IPv6 Stateless Address Autoconfiguration), and (Enhanced Duplicate Address Detection). The parameters are defined in Section 6.2.1 and 6.3.2 of , Section 5.1 of , and Section 3.4 of . Coverage of IPv6 ND Functions in YANG Modules
RFC
(Section)		 Function/Parameter Covered by Path
4861
s5.1		 Neighbor Cache ietf-ip /if:interfaces
/if:interface
/ip:ipv6
/ip:neighbor
4862
s5.1		 Prefix List
(AdvPrefixList)		 ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:prefix-list
4861
s6.2.1		 IsRouter ietf-ip /if:interfaces
/if:interface
/ip:ipv6
/ip:forwarding
4861
s6.2.1		 AdvSendAdvertisements ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:ipv6-router
-advertisements
4861
s6.2.1		 MaxRtrAdvInterval ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:max-rtr
-adv-interval
4861
s6.2.1		 MinRtrAdvInterval ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:min-rtr
-adv-interval
4861
s6.2.1		 AdvManagedFlag ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6/
v6ur:managed-flag
4861
s6.2.1		 AdvOtherConfigFlag ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:other-
config-flag
4861
s6.2.1		 AdvLinkMTU ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:link-mtu
4861
s6.2.1		 AdvReachableTime ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:reachable-time
4861
s6.2.1		 AdvRetransTimer ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:retrans-timer
4861
s6.2.1		 AdvCurHopLimit ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:cur-hop-limit
4861
s6.2.1		 AdvDefaultLifetime ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:default-lifetime
4861
s6.2.1		 AdvPrefixList/
AdvValidLifetime		 ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:prefix-list
/v6ur:prefix
/v6ur:control-adv
-prefixes
/v6ur:advertise
/v6ur:valid
-lifetime
4861
s6.2.1		 AdvPrefixList/
AdvOnLinkFlag		 ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:prefix-list
/v6ur:prefix
/v6ur:control-adv
-prefixes
/v6ur:advertise/
v6ur:on-link-flag
4861
s6.2.1		 AdvPrefixList/
AdvPreferredLifetime		 ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:prefix-list
/v6ur:prefix
/v6ur:control-adv
-prefixes
/v6ur:advertise
/v6ur:preferred
-lifetime
4861
s6.2.1		 AdvPrefixList/
AdvAutonomousFlag		 ietf-ipv6-
router-
advertisements		 /if:interfaces
/if:interface
/ip:ipv6
/v6ur:prefix-list
/v6ur:prefix
/v6ur:control-adv
-prefixes
/v6ur:advertise
/v6ur:autonomous
-flag
4861
s6.3.2		 LinkMTU - -
4861
s6.3.2		 CurHopLimit - -
4861
s6.3.2		 BaseReachableTime ietf-ipv6-nd /if:interfaces
/if:interface
/ip:ipv6/v6nd:nd
/v6nd:reachable
-time
4861
s6.3.2		 ReachableTime - -
4861
s6.3.2 /4862
s5.1		 RetransTimer ietf-ipv6-nd /if:interfaces
/if:interface
/ip:ipv6/v6nd:nd
/v6nd:retrans
-timer
4861
s7.2.8		 Proxy Neighbor
Advertisements		 ietf-ipv6-nd /if:interfaces
/if:interface
/ip:ipv6/v6nd:nd
/v6nd:proxy-na
4861
s8		 Redirect ietf-ipv6-nd /if:interfaces
/if:interface
/ip:ipv6/v6nd:nd
/v6nd:redirect
4862
s5.1		 DupAddrDetectTransmits ietf-ip /if:interfaces
/if:interface
/ip:ipv6/ip:dup
-addr-detect
-transmits
4862
s5.5		 Creation of Global
Addresses		 ietf-ip /if:interfaces
/if:interface
/ip:ipv6
/ip:autoconf
/ip:create-
global-
addresses
8981
s3.4		 Creation of Temporary
Addresses		 ietf-ip /if:interfaces
/if:interface
/ip:ipv6
/ip:autoconf
/ip:create-
temporary-
addresses
8981
s3.4		 TEMP_VALID_LIFETIME ietf-ip /if:interfaces
/if:interface
/ip:ipv6
/ip:autoconf
/ip:temporary-
valid-lifetime
8981
s3.4		 TEMP_PREFERRED_
LIFETIME		 ietf-ip /if:interfaces
/if:interface
/ip:ipv6
/ip:autoconf
/ip:temporary-
preferred-
lifetime
7527
s4		 Enhanced Duplicate
Address Detection		 ietf-ipv6-nd /if:interfaces
/if:interface
/ip:ipv6/v6nd:nd/
v6nd:enhanced-dad
7527
s5		 Automated Resolving
of Duplicates		 ietf-ipv6-nd /if:interfaces
/if:interface
/ip:ipv6/v6nd:nd/
v6nd:auto-resolve
Huawei
China hanbin3@huawei.com