6MAN F. Zhang Internet-Draft Y. Zhu Intended status: Standards Track China Telecom Expires: 6 May 2027 B. Wu Huawei J. Hu China Telecom 2 November 2026 YANG Data Model for IPv6 Neighbor Discovery draft-ietf-6man-ipv6-neighbor-discovery-yang-09 Abstract This document defines a YANG data model to configure and manage IPv6 Neighbor Discovery (ND) and related functions, including IPv6 address resolution, redirect function, proxy Neighbor Advertisement, Neighbor Unreachability Detection (NUD), Duplicate Address Detection (DAD), and Enhanced Duplicate Address Detection. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 6 May 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components Zhang, et al. Expires 6 May 2027 [Page 1] Internet-Draft ND YANG model November 2026 extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 1.2. Tree Diagrams . . . . . . . . . . . . . . . . . . . . . . 4 2. Design of the Data Model . . . . . . . . . . . . . . . . . . 4 2.1. IPv6 Address Resolution and Redirect Function . . . . . . 4 2.2. Neighbor Unreachability Detection . . . . . . . . . . . . 5 2.3. Proxy Neighbor Advertisement . . . . . . . . . . . . . . 5 2.4. Duplicate Address Detection . . . . . . . . . . . . . . . 5 2.5. IPv6 Neighbor Discovery Data Model . . . . . . . . . . . 6 3. IPv6 Neighbor Discovery YANG Module . . . . . . . . . . . . . 8 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16 5. Security Considerations . . . . . . . . . . . . . . . . . . . 16 6. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 18 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 18 7.1. Normative References . . . . . . . . . . . . . . . . . . 18 7.2. Informative References . . . . . . . . . . . . . . . . . 20 Appendix A. Example Proxy Neighbor Advertisement, Redirect, NUD, and DAD Configuration . . . . . . . . . . . . . . . . . . 21 Appendix B. Coverage of IPv6 ND Functions and Parameters in YANG Modules . . . . . . . . . . . . . . . . . . . . . . . . . 23 Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 28 1. Introduction This document defines a YANG [RFC7950] data model "ietf-ipv6-nd" to configure and manage IPv6 Neighbor Discovery (ND) and related functions. Basic neighbor management functionality is supported by the "ietf-ip" YANG data model [RFC8344], and [I-D.ietf-intarea-arp-yang-model] extends the basic ARP YANG functionality to cover optional ARP features and related statistics, which applies only to IPv4. Thus, an extension for IPv6 is required to maintain the IPv6 Neighbor Cache entries. [RFC4861] specifies the Neighbor Discovery protocol for IPv6, while [RFC4862] specifies IPv6 Stateless Address Autoconfiguration (SLAAC). This document covers IPv6 address resolution, redirect function, proxy Neighbor Advertisement, and NUD, as defined in [RFC4861], as well as DAD, as defined in [RFC4862], and Enhanced DAD, as deined in [RFC7527]. Zhang, et al. Expires 6 May 2027 [Page 2] Internet-Draft ND YANG model November 2026 Other functions defined in these RFCs are covered by existing YANG data models. Specifically, Router and Prefix Discovery [RFC4861] are covered by submodule "ietf-ipv6-router-advertisements" [RFC8349], and static Neighbor Cache entries and Stateless Address Autoconfiguration [RFC4862] are covered by module "ietf-ip" [RFC8344]. Neighbor Discovery Optimization for 6LoWPANs [RFC6775] and other related extensions, such as those specified in [RFC8505], [RFC8928], and [RFC9010], are out of scope of this document. 1.1. Terminology The following terms are defined in [RFC8342]: * configuration * system state * operational state The following terms are defined in [RFC7950]: * augment * container * data model * data node * leaf * list * module * schema tree The following terms are defined in [RFC4861]: * Neighbor Discovery * Neighbor Advertisement * proxy Neighbor Advertisement * Neighbor Unreachability Detection Zhang, et al. Expires 6 May 2027 [Page 3] Internet-Draft ND YANG model November 2026 The following terms are defined in [RFC4862]: * Duplicate Address Detection * Stateless Address Autoconfiguration The following term is defined in [RFC7527]: * Enhanced Duplicate Address Detection 1.2. Tree Diagrams Tree diagrams used in this document follow the notation defined in [RFC8340]. 2. Design of the Data Model The YANG data model for IPv6 ND augments the "ietf-ip" [RFC8344] to provide per-interface configuration and management of IPv6 address resolution and redirect functions based on the IPv6 ND protocol, as well as other related functions, including proxy Neighbor Advertisement, NUD, DAD, and Enhanced DAD. Note that the features related to ICMP Router and Prefix Discovery are out of scope of this module, since they have already been defined in the submodule "ietf-ipv6-router-advertisements" [RFC8349]. Static Neighbor Cache entries and SLAAC [RFC4862] are also out of scope, as they are covered by "ietf-ip" [RFC8344]. 2.1. IPv6 Address Resolution and Redirect Function The data model augments the "/if:interfaces/if:interface/ip:ipv6" path defined in the "ietf-ip" module [RFC8344] for the IPv6 ND protocol [RFC4861]. The "retrans-timer" leaf defines the interval of retransmitting Neighbor Solicitation messages when a node tries to learn the link- layer address of another node. The "redirect" leaf enables the sending of Redirect messages. The default behavior of IPv6 Redirects may vary depending on the deployment scenario. [RFC4861] specifies the expected Redirect behavior, while [RFC8504] recommends disabling Redirects by default on routers intended for core networks, but allows them to be enabled by default on routers intended to support hosts on edge networks. Therefore, this model does not specify a default value for the "redirect" leaf, leaving the default behavior to the implementation and deployment requirements. Zhang, et al. Expires 6 May 2027 [Page 4] Internet-Draft ND YANG model November 2026 The "statistics" container defines a collection of per-interface operational statistics for each type of IPv6 ND message. 2.2. Neighbor Unreachability Detection The "reachable-time" leaf defines the time to confirm a neighbor's reachability for NUD. A neighbor's state changes from REACHABLE to STALE when there is no other reachability confirmation from the neighbor within the "reachable-time". The "retrans-timer" leaf also indicates the interval for retransmitting Neighbor Solicitation messages used by NUD. 2.3. Proxy Neighbor Advertisement The "proxy-na" leaf augmenting "ietf-ip" [RFC8344] defines the configuration of proxy Neighbor Advertisements [RFC4861], which indicate that a router is willing to accept packets not explicitly addressed to itself. After receiving a Neighbor Solicitation message whose destination address is not its own IPv6 address, a proxy router replies to the source with a Neighbor Advertisement message carrying its own link-layer address and the IPv6 address of the original destination. 2.4. Duplicate Address Detection The "dup-addr-detect-transmits" leaf, as defined in "ietf-ip" [RFC8344], indicates the number of consecutive Neighbor Solicitation messages sent while performing Duplicate Address Detection (DAD) [RFC4862]. The value of "dup-addr-detect-transmits" can be set to 0 to disable DAD. The "retrans-timer" leaf also indicates the interval for retransmitting Neighbor Solicitation messages during DAD. The "enhanced-dad" container augmenting "ietf-ip" [RFC8344] defines the configuration for Enhanced DAD [RFC7527], which is used to automatically detect the looped-back IPv6 ND messages used in DAD. The "auto-resolve" leaf enables automated action when a genuine duplicate is detected by Enhanced DAD. Section 5 of [RFC7527] describes a use case in which a trusted router serves untrusted IPv6 host nodes. In such a scenario, automated actions may include logging a system management message, dropping the received ND message, or blocking the node associated with the duplicate NS (DAD) or NA message. The specific actions, including the scope and duration of any blocking and the procedure for restoring service, are implementation-specific and are out of scope of this model. Zhang, et al. Expires 6 May 2027 [Page 5] Internet-Draft ND YANG model November 2026 2.5. IPv6 Neighbor Discovery Data Model This document defines the YANG module "ietf-ipv6-nd", which has the following structure. module: ietf-ipv6-nd augment /if:interfaces/if:interface/ip:ipv6: +--rw nd +--rw reachable-time? uint32 +--rw retrans-timer? uint32 +--rw redirect? boolean +--rw proxy-na? boolean +--rw enhanced-dad | +--rw enable? boolean | +--rw auto-resolve? boolean {auto-resolve}? +--ro statistics +--ro neighbor-solicitation | +--ro in-pkts? yang:counter64 | +--ro out-pkts? yang:counter64 | +--ro drop-pkts? yang:counter64 | +--ro in-unicast-pkts? yang:counter64 | +--ro in-multicast-pkts? yang:counter64 | +--ro out-unicast-pkts? yang:counter64 | +--ro out-multicast-pkts? yang:counter64 | +--ro drop-bad-code-pkts? yang:counter64 | +--ro drop-bad-hoplimit-pkts? yang:counter64 | +--ro drop-bad-len-pkts? yang:counter64 | +--ro drop-bad-option-pkts? yang:counter64 | +--ro drop-checksum-err-pkts? yang:counter64 | +--ro drop-fragmented-pkts? yang:counter64 | +--ro out-nud-pkts? yang:counter64 +--ro neighbor-advertisement | +--ro in-pkts? yang:counter64 | +--ro out-pkts? yang:counter64 | +--ro drop-pkts? yang:counter64 | +--ro in-unicast-pkts? yang:counter64 | +--ro in-multicast-pkts? yang:counter64 | +--ro out-unicast-pkts? yang:counter64 | +--ro out-multicast-pkts? yang:counter64 | +--ro drop-bad-code-pkts? yang:counter64 | +--ro drop-bad-hoplimit-pkts? yang:counter64 | +--ro drop-bad-len-pkts? yang:counter64 | +--ro drop-bad-option-pkts? yang:counter64 | +--ro drop-checksum-err-pkts? yang:counter64 | +--ro drop-fragmented-pkts? yang:counter64 | +--ro in-solicited-pkts? yang:counter64 | +--ro in-unsolicited-pkts? yang:counter64 Zhang, et al. Expires 6 May 2027 [Page 6] Internet-Draft ND YANG model November 2026 | +--ro in-override-pkts? yang:counter64 | +--ro in-nonoverride-pkts? yang:counter64 | +--ro out-solicited-pkts? yang:counter64 | +--ro out-unsolicited-pkts? yang:counter64 | +--ro out-override-pkts? yang:counter64 | +--ro out-nonoverride-pkts? yang:counter64 +--ro router-solicitation | +--ro in-pkts? yang:counter64 | +--ro out-pkts? yang:counter64 | +--ro drop-pkts? yang:counter64 | +--ro in-unicast-pkts? yang:counter64 | +--ro in-multicast-pkts? yang:counter64 | +--ro out-unicast-pkts? yang:counter64 | +--ro out-multicast-pkts? yang:counter64 | +--ro drop-bad-code-pkts? yang:counter64 | +--ro drop-bad-hoplimit-pkts? yang:counter64 | +--ro drop-bad-len-pkts? yang:counter64 | +--ro drop-bad-option-pkts? yang:counter64 | +--ro drop-checksum-err-pkts? yang:counter64 | +--ro drop-fragmented-pkts? yang:counter64 +--ro router-advertisement | +--ro in-pkts? yang:counter64 | +--ro out-pkts? yang:counter64 | +--ro drop-pkts? yang:counter64 | +--ro in-unicast-pkts? yang:counter64 | +--ro in-multicast-pkts? yang:counter64 | +--ro out-unicast-pkts? yang:counter64 | +--ro out-multicast-pkts? yang:counter64 | +--ro drop-bad-code-pkts? yang:counter64 | +--ro drop-bad-hoplimit-pkts? yang:counter64 | +--ro drop-bad-len-pkts? yang:counter64 | +--ro drop-bad-option-pkts? yang:counter64 | +--ro drop-checksum-err-pkts? yang:counter64 | +--ro drop-fragmented-pkts? yang:counter64 +--ro redirect +--ro in-pkts? yang:counter64 +--ro out-pkts? yang:counter64 +--ro drop-pkts? yang:counter64 +--ro drop-bad-code-pkts? yang:counter64 +--ro drop-bad-hoplimit-pkts? yang:counter64 +--ro drop-bad-len-pkts? yang:counter64 +--ro drop-bad-option-pkts? yang:counter64 +--ro drop-checksum-err-pkts? yang:counter64 +--ro drop-fragmented-pkts? yang:counter64 augment /if:interfaces/if:interface/ip:ipv6/ip:neighbor: +--ro age? uint32 Zhang, et al. Expires 6 May 2027 [Page 7] Internet-Draft ND YANG model November 2026 3. IPv6 Neighbor Discovery YANG Module This section presents the YANG module of IPv6 Neighbor Discovery defined in this document. This module imports modules from Common YANG Data Types [RFC9911], A YANG Data Model for Interface Management [RFC8343], and A YANG Data Model for IP Management [RFC8344]. file "ietf-ipv6-nd@2026-11-02.yang" module ietf-ipv6-nd { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-ipv6-nd"; prefix v6nd; import ietf-yang-types { prefix yang; reference "RFC 9911: Common YANG Data Types"; } import ietf-interfaces { prefix if; reference "RFC 8343: A YANG Data Model for Interface Management"; } import ietf-ip { prefix ip; reference "RFC 8344: A YANG Data Model for IP Management"; } organization "IETF 6MAN (IPv6 Maintenance) Working Group"; contact "WG Web: WG List: 6MAN Author: Fan Zhang Author: Yongqing Zhu Author: Bo Wu Author: Jiayuan Hu "; description Zhang, et al. Expires 6 May 2027 [Page 8] Internet-Draft ND YANG model November 2026 "This YANG module defines a YANG data model to configure and manage IPv6 Neighbor Discovery (ND) and related functions, including IPv6 address resolution, redirect, proxy Neighbor Advertisement, Neighbor Unreachability Detection (NUD), Duplicate Address Detection (DAD), and Enhanced DAD. Copyright (c) 2026 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). All revisions of IETF and IANA published modules can be found at the YANG Parameters registry group (https://www.iana.org/assignments/yang-parameters). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices."; // RFC Ed: replace '2026-11-02' with the module publication date // the format is (YYYY-MM-DD) // replace XXXX with actual RFC number and remove // this note revision 2026-11-02 { description "Initial version."; reference "RFC XXXX: YANG Data Model for IPv6 Neighbor Discovery"; } /* Features */ feature auto-resolve { description "Indicates support for automated action when a duplicate is detected by Enhanced DAD."; } /* Groupings */ grouping nd-basic-statistics { description Zhang, et al. Expires 6 May 2027 [Page 9] Internet-Draft ND YANG model November 2026 "Grouping for basic statistics for IPv6 ND messages."; leaf in-pkts { type yang:counter64; description "The total number of packets received."; } leaf out-pkts { type yang:counter64; description "The total number of packets transmitted."; } leaf drop-pkts { type yang:counter64; description "The total number of packets discarded."; } } grouping nd-unicast-multicast-statistics { description "Grouping for statistics for IPv6 ND messages categorized by unicast and multicast."; leaf in-unicast-pkts { type yang:counter64; description "The total number of packets received with the destination address as a unicast address."; } leaf in-multicast-pkts { type yang:counter64; description "The total number of packets received with the destination address as a multicast address."; } leaf out-unicast-pkts { type yang:counter64; description "The total number of packets transmitted with the destination address as a unicast address."; } leaf out-multicast-pkts { type yang:counter64; description "The total number of packets transmitted with the destination address as a multicast address."; } } Zhang, et al. Expires 6 May 2027 [Page 10] Internet-Draft ND YANG model November 2026 grouping nd-drop-statistics { description "Grouping for statistics for IPv6 ND messages discarded by reason."; leaf drop-bad-code-pkts { type yang:counter64; description "The total number of packets discarded due to invalid code."; } leaf drop-bad-hoplimit-pkts { type yang:counter64; description "The total number of packets discarded due to invalid hop limits."; } leaf drop-bad-len-pkts { type yang:counter64; description "The total number of packets discarded due to invalid length."; } leaf drop-bad-option-pkts { type yang:counter64; description "The total number of packets discarded due to invalid option."; } leaf drop-checksum-err-pkts { type yang:counter64; description "The total number of packets discarded due to checksum errors."; } leaf drop-fragmented-pkts { type yang:counter64; description "The total number of packets discarded due to fragmentation."; } } /* Data nodes */ augment "/if:interfaces/if:interface/ip:ipv6" { description "Augments interface configuration and state data with parameters of IPv6 ND."; container nd { description "Parameters of IPv6 ND."; leaf reachable-time { type uint32; Zhang, et al. Expires 6 May 2027 [Page 11] Internet-Draft ND YANG model November 2026 units "milliseconds"; default "30000"; description "The time to confirm a neighbor's reachability for NUD."; reference "RFC4861: Neighbor Discovery for IP version 6 (IPv6) Section 6.3.2 - BaseReachableTime"; } leaf retrans-timer { type uint32 { range "1..max"; } units "milliseconds"; default "1000"; description "The interval of retransmitting Neighbor Solicitations to a neighbor for address resolution, NUD, or DAD."; reference "RFC4861: Neighbor Discovery for IP version 6 (IPv6) Section 6.3.2 - RetransTimer"; } leaf redirect { type boolean; default "false"; description "Controls whether the sending of ICMP Redirect messages on the interface is enabled or disabled. true - Sending of ICMP Redirect messages is enabled, false - Sending of ICMP Redirect messages is disabled. The default behaviour is implementation-specific and may depend on the deployment scenario. A deviation could be used to specify a implementation-specific default."; reference "RFC4861: Neighbor Discovery for IP version 6 (IPv6) Section 8 RFC8504: IPv6 Node Requirements Section 5.4"; } leaf proxy-na { type boolean; default "false"; description "Controls whether the router proxies for one or more other nodes by sending proxy Neighbor Advertisement. true - Proxy NA is enabled, false - Proxy NA is disabled."; reference Zhang, et al. Expires 6 May 2027 [Page 12] Internet-Draft ND YANG model November 2026 "RFC4861: Neighbor Discovery for IP version 6 (IPv6) Section 7.2.8"; } container enhanced-dad { description "Parameters of Enhanced DAD algorithm."; leaf enable { type boolean; default "false"; description "Controls whether the Enhanced DAD algorithm is enabled or disabled."; reference "RFC7527: Enhanced Duplicate Address Detection Section 4"; } leaf auto-resolve { when "../enable = 'true'"; if-feature auto-resolve; type boolean; default "false"; description "Controls whether the automated action is enabled when detecting duplicates."; reference "RFC7527: Enhanced Duplicate Address Detection Section 5"; } reference "RFC7527: Enhanced Duplicate Address Detection"; } container statistics { config false; description "A collection of interface-related statistics about IPv6 ND messages. For all IPv6 ND interface counters, discontinuities in the value can occur at re-initialization of the management system and at other times as indicated by the value of '../../statistics/discontinuity-time' in the ietf-interfaces YANG module."; container neighbor-solicitation { description "Statistics for Neighbor Solicitation packets."; uses nd-basic-statistics; uses nd-unicast-multicast-statistics; uses nd-drop-statistics; Zhang, et al. Expires 6 May 2027 [Page 13] Internet-Draft ND YANG model November 2026 leaf out-nud-pkts { type yang:counter64; description "The total number of NS packets transmitted for NUD."; } } container neighbor-advertisement { description "Statistics for Neighbor Advertisement packets."; uses nd-basic-statistics; uses nd-unicast-multicast-statistics; uses nd-drop-statistics; leaf in-solicited-pkts { type yang:counter64; description "The total number of solicited NA packets received."; } leaf in-unsolicited-pkts { type yang:counter64; description "The total number of unsolicited NA packets received."; } leaf in-override-pkts { type yang:counter64; description "The total number of override NA packets received."; } leaf in-nonoverride-pkts { type yang:counter64; description "The total number of non-override NA packets received."; } leaf out-solicited-pkts { type yang:counter64; description "The total number of solicited NA packets transmitted."; } leaf out-unsolicited-pkts { type yang:counter64; description "The total number of unsolicited NA packets transmitted."; } leaf out-override-pkts { type yang:counter64; description "The total number of override NA packets transmitted."; } leaf out-nonoverride-pkts { Zhang, et al. Expires 6 May 2027 [Page 14] Internet-Draft ND YANG model November 2026 type yang:counter64; description "The total number of non-override NA packets transmitted."; } } container router-solicitation { description "Statistics for Router Solicitation packets."; uses nd-basic-statistics; uses nd-unicast-multicast-statistics; uses nd-drop-statistics; } container router-advertisement { description "Statistics for Router Advertisement packets."; uses nd-basic-statistics; uses nd-unicast-multicast-statistics; uses nd-drop-statistics; } container redirect { description "Statistics for Redirect packets."; uses nd-basic-statistics; uses nd-drop-statistics; } } } } augment "/if:interfaces/if:interface/ip:ipv6/ip:neighbor" { description "Augments IPv6 neighbor list with parameters of IPv6 address resolution based on IPv6 ND."; leaf age { when "../ip:origin = 'dynamic'"; type uint32; units "seconds"; config false; description "The time that has passed since receipt of the last reachability confirmation for the neighbor. This leaf is present only for dynamic neighbor entries."; reference "RFC4861: Neighbor Discovery for IP version 6 (IPv6) Section 7.3.3"; } } Zhang, et al. Expires 6 May 2027 [Page 15] Internet-Draft ND YANG model November 2026 } 4. IANA Considerations IANA is requested to register the following URI in the "ns" registry within the "IETF XML Registry" group [RFC3688]: URI: urn:ietf:params:xml:ns:yang:ietf-ipv6-nd Registrant Contact: The IESG XML: N/A; the requested URI is an XML namespace. IANA is requested to register the following YANG module in the "YANG Module Names" registry [RFC6020] within the "YANG Parameters" registry group. Name: ietf-ipv6-nd Maintained by IANA? N Namespace: urn:ietf:params:xml:ns:yang:ietf-ipv6-nd Prefix: v6nd Reference: RFC XXXX 5. Security Considerations This section is modeled after the template described in Section 3.7.1 of [RFC9907]. The "ietf-ipv6-nd" YANG module defines a data model that is designed to be accessed via YANG-based management protocols, such as the Network Configuration Protocol (NETCONF) [RFC6241] and RESTCONF [RFC8040]. These YANG-based management protocols (1) have to use a secure transport layer (e.g., Secure Shell (SSH) [RFC4253], TLS [RFC9846], and QUIC [RFC9000]) and (2) have to use mutual authentication. The Network Configuration Access Control Model (NACM) [RFC8341] provides the means to restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. There are a number of data nodes defined in this YANG module that are writable/creatable/deletable (i.e., "config true", which is the default). All writable data nodes are likely to be sensitive or vulnerable in some network environments. Write operations (e.g., edit-config) and delete operations to these data nodes without proper protection or authentication can have a negative effect on network operations. The following subtrees and data nodes have particular sensitivities/vulnerabilities: Zhang, et al. Expires 6 May 2027 [Page 16] Internet-Draft ND YANG model November 2026 * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:reachable-time This leaf is used to consider a neighbor reachable since the last confirmation of reachability. An excessively large value could prolong the use of stale or spoofed Neighbor Cache entries, while an excessively small value could cause unnecessarily frequent NUDs. * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:retrans-timer This leaf is used to set the interval of retransmitting Neighbor Solicitations. An excessively small value could cause excessive NS traffic and increase network load, potentially resulting in denial of service. * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:redirect This leaf is used to enable the sending of Redirect messages on an interface. Unauthorized or mistaken changes to this leaf could cause traffic to be misdirected, potentially resulting in traffic hijacking, denial of service, or on-path attacks. * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:proxy-na This leaf is used to enable proxy Neighbor Advertisement on an interface. Unauthorized or mistaken changes to this leaf could cause traffic to be misdirected, potentially enabling traffic interception or denial of service. * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:enhanced-dad/ v6nd:enable This leaf is used to enable Enhanced DAD algorithm on an interface. Unauthorized or mistaken changes to this leaf could disable Enhanced DAD, causing looped back NS (DAD) messages to be incorrectly interpreted as indicating duplicate addresses and potentially preventing legitimate IPv6 addresses from being configured. * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:enhanced-dad/ v6nd:auto-resolve This leaf is used to enable the automated resolution when detecting duplicates by the Enhanced DAD algorithm on an interface, which could trigger automated actions that affect legitimate hosts or cause ND messages to be dropped, potentially resulting in denial of service. Some of the readable data nodes in this YANG module may be considered sensitive or vulnerable in some network environments. It is thus important to control read access (e.g., via get, get-config, or Zhang, et al. Expires 6 May 2027 [Page 17] Internet-Draft ND YANG model November 2026 notification) to these data nodes. Specifically, the following subtrees and data nodes have particular sensitivities/ vulnerabilities: * /if:interfaces/if:interface/ip:ipv6/ip:neighbor/v6nd:age Unauthorized access to this node may disclose information about IPv6 neighbor reachability and behavior patterns on the network. * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:redirect * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:proxy-na * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:enhanced-dad Unauthorized access to these nodes may disclose behavior patterns and security-related configuration of IPv6 Neighbor Discovery functions. * /if:interfaces/if:interface/ip:ipv6/v6nd:nd/v6nd:statistics Unauthorized access to this subtree may disclose information about neighbor activity and behavior patterns, including probing, packet drops and redirect. 6. Acknowledgments The authors would like to thank Bin Han, Acee Lindem, Jen Linkova, Éric Vyncke, Changwang Lin, and many others for their helpful comments and suggestions. Thanks to Ebben Aries for the YANG Doctors review. Thanks to Yaroslav Rosomakho for the SECDIR review. Thanks to Carlos Pignataro for the INTDIR review. Thanks to Roni Even for the GENART review. Thanks to Tina Tsou for the OPSDIR review. 7. References 7.1. Normative References [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, DOI 10.17487/RFC3688, January 2004, . [RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, "Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, DOI 10.17487/RFC4861, September 2007, . Zhang, et al. Expires 6 May 2027 [Page 18] Internet-Draft ND YANG model November 2026 [RFC4862] Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless Address Autoconfiguration", RFC 4862, DOI 10.17487/RFC4862, September 2007, . [RFC6020] Bjorklund, M., Ed., "YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)", RFC 6020, DOI 10.17487/RFC6020, October 2010, . [RFC7527] Asati, R., Singh, H., Beebee, W., Pignataro, C., Dart, E., and W. George, "Enhanced Duplicate Address Detection", RFC 7527, DOI 10.17487/RFC7527, April 2015, . [RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language", RFC 7950, DOI 10.17487/RFC7950, August 2016, . [RFC8341] Bierman, A. and M. Bjorklund, "Network Configuration Access Control Model", STD 91, RFC 8341, DOI 10.17487/RFC8341, March 2018, . [RFC8342] Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K., and R. Wilton, "Network Management Datastore Architecture (NMDA)", RFC 8342, DOI 10.17487/RFC8342, March 2018, . [RFC8343] Bjorklund, M., "A YANG Data Model for Interface Management", RFC 8343, DOI 10.17487/RFC8343, March 2018, . [RFC8344] Bjorklund, M., "A YANG Data Model for IP Management", RFC 8344, DOI 10.17487/RFC8344, March 2018, . [RFC8349] Lhotka, L., Lindem, A., and Y. Qu, "A YANG Data Model for Routing Management (NMDA Version)", RFC 8349, DOI 10.17487/RFC8349, March 2018, . [RFC8504] Chown, T., Loughney, J., and T. Winters, "IPv6 Node Requirements", BCP 220, RFC 8504, DOI 10.17487/RFC8504, January 2019, . Zhang, et al. Expires 6 May 2027 [Page 19] Internet-Draft ND YANG model November 2026 [RFC9911] Schönwälder, J., Ed., "Common YANG Data Types", RFC 9911, DOI 10.17487/RFC9911, December 2025, . 7.2. Informative References [RFC4253] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH) Transport Layer Protocol", RFC 4253, DOI 10.17487/RFC4253, January 2006, . [RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., and A. Bierman, Ed., "Network Configuration Protocol (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, . [RFC6775] Shelby, Z., Ed., Chakrabarti, S., Nordmark, E., and C. Bormann, "Neighbor Discovery Optimization for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs)", RFC 6775, DOI 10.17487/RFC6775, November 2012, . [RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017, . [RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams", BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018, . [RFC8505] Thubert, P., Ed., Nordmark, E., Chakrabarti, S., and C. Perkins, "Registration Extensions for IPv6 over Low-Power Wireless Personal Area Network (6LoWPAN) Neighbor Discovery", RFC 8505, DOI 10.17487/RFC8505, November 2018, . [RFC8928] Thubert, P., Ed., Sarikaya, B., Sethi, M., and R. Struik, "Address-Protected Neighbor Discovery for Low-Power and Lossy Networks", RFC 8928, DOI 10.17487/RFC8928, November 2020, . [RFC8981] Gont, F., Krishnan, S., Narten, T., and R. Draves, "Temporary Address Extensions for Stateless Address Autoconfiguration in IPv6", RFC 8981, DOI 10.17487/RFC8981, February 2021, . Zhang, et al. Expires 6 May 2027 [Page 20] Internet-Draft ND YANG model November 2026 [RFC9000] Iyengar, J., Ed. and M. Thomson, Ed., "QUIC: A UDP-Based Multiplexed and Secure Transport", RFC 9000, DOI 10.17487/RFC9000, May 2021, . [RFC9010] Thubert, P., Ed. and M. Richardson, "Routing for RPL (Routing Protocol for Low-Power and Lossy Networks) Leaves", RFC 9010, DOI 10.17487/RFC9010, April 2021, . [RFC9846] Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 9846, DOI 10.17487/RFC9846, July 2026, . [RFC9907] Bierman, A., Boucadair, M., Ed., and Q. Wu, "Guidelines for Authors and Reviewers of Documents Containing YANG Data Models", BCP 216, RFC 9907, DOI 10.17487/RFC9907, March 2026, . [I-D.ietf-intarea-arp-yang-model] Zheng, F., Wu, B., Wilton, R., Zhang, F., Zhu, Y., and X. Ding, "A YANG Data Model for ARP Extensions", Work in Progress, Internet-Draft, draft-ietf-intarea-arp-yang- model-02, 30 October 2026, . Appendix A. Example Proxy Neighbor Advertisement, Redirect, NUD, and DAD Configuration This example illustrates the configuration of enabling proxy Neighbor Advertisement, Redirect, NUD, DAD, and Enhanced DAD on interface eth0 with setting the "dup-addr-detect-transmits" leaf to 2, the "reachable-time" leaf to 40,000 milliseconds, and the "retrans-timer" leaf to 2,000 milliseconds, using the ietf-interfaces module [RFC8343], the ietf-ip module [RFC8344], and the IPv6 ND module. Zhang, et al. Expires 6 May 2027 [Page 21] Internet-Draft ND YANG model November 2026 eth0 ianaift:ethernetCsmacd 2 40000 2000 true true true true The following is the same example using JSON format. Zhang, et al. Expires 6 May 2027 [Page 22] Internet-Draft ND YANG model November 2026 { "ietf-interfaces:interfaces": { "interface": [ { "name": "eth0", "type": "iana-if-type:ethernetCsmacd", "ietf-ip:ipv6": { "dup-addr-detect-transmits": 2, "ietf-ipv6-nd:nd": { "reachable-time": 40000, "retrans-timer": 2000, "redirect": true, "proxy-na": true, "enhanced-dad": { "enable": true, "auto-resolve": true } } } } ] } } Appendix B. Coverage of IPv6 ND Functions and Parameters in YANG Modules This appendix summarizes the functional elements related to the IPv6 ND protocol and identifies whether they are covered by existing IETF YANG modules or defined in this document. The table below maps the relevant RFCs, functions or parameters, the corresponding YANG modules, and their specific data paths. The functions are defined in [RFC4861] (Neighbor Discovery for IP version 6 (IPv6)), [RFC4862] (IPv6 Stateless Address Autoconfiguration), and [RFC7527] (Enhanced Duplicate Address Detection). The parameters are defined in Section 6.2.1 and 6.3.2 of [RFC4861], Section 5.1 of [RFC4862], and Section 3.4 of [RFC8981]. +=========+======================+==============+=================+ |RFC |Function/Parameter |Covered by |Path | |(Section)| | | | +=========+======================+==============+=================+ |4861 |Neighbor Cache |ietf-ip |/if:interfaces | |s5.1 | | |/if:interface | | | | |/ip:ipv6 | Zhang, et al. Expires 6 May 2027 [Page 23] Internet-Draft ND YANG model November 2026 | | | |/ip:neighbor | +---------+----------------------+--------------+-----------------+ |4862 |Prefix List |ietf-ipv6- |/if:interfaces | |s5.1 |(AdvPrefixList) |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:prefix-list| +---------+----------------------+--------------+-----------------+ |4861 |IsRouter |ietf-ip |/if:interfaces | |s6.2.1 | | |/if:interface | | | | |/ip:ipv6 | | | | |/ip:forwarding | +---------+----------------------+--------------+-----------------+ |4861 |AdvSendAdvertisements |ietf-ipv6- |/if:interfaces | |s6.2.1 | |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:ipv6-router| | | | |-advertisements | +---------+----------------------+--------------+-----------------+ |4861 |MaxRtrAdvInterval |ietf-ipv6- |/if:interfaces | |s6.2.1 | |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:max-rtr | | | | |-adv-interval | +---------+----------------------+--------------+-----------------+ |4861 |MinRtrAdvInterval |ietf-ipv6- |/if:interfaces | |s6.2.1 | |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:min-rtr | | | | |-adv-interval | +---------+----------------------+--------------+-----------------+ |4861 |AdvManagedFlag |ietf-ipv6- |/if:interfaces | |s6.2.1 | |router- |/if:interface | | | |advertisements|/ip:ipv6/ | | | | |v6ur:managed-flag| +---------+----------------------+--------------+-----------------+ |4861 |AdvOtherConfigFlag |ietf-ipv6- |/if:interfaces | |s6.2.1 | |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:other- | | | | |config-flag | +---------+----------------------+--------------+-----------------+ |4861 |AdvLinkMTU |ietf-ipv6- |/if:interfaces | |s6.2.1 | |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:link-mtu | +---------+----------------------+--------------+-----------------+ |4861 |AdvReachableTime |ietf-ipv6- |/if:interfaces | |s6.2.1 | |router- |/if:interface | Zhang, et al. Expires 6 May 2027 [Page 24] Internet-Draft ND YANG model November 2026 | | |advertisements|/ip:ipv6 | | | | |/v6ur:reachable- | | | | |time | +---------+----------------------+--------------+-----------------+ |4861 |AdvRetransTimer |ietf-ipv6- |/if:interfaces | |s6.2.1 | |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:retrans- | | | | |timer | +---------+----------------------+--------------+-----------------+ |4861 |AdvCurHopLimit |ietf-ipv6- |/if:interfaces | |s6.2.1 | |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:cur-hop- | | | | |limit | +---------+----------------------+--------------+-----------------+ |4861 |AdvDefaultLifetime |ietf-ipv6- |/if:interfaces | |s6.2.1 | |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:default- | | | | |lifetime | +---------+----------------------+--------------+-----------------+ |4861 |AdvPrefixList/ |ietf-ipv6- |/if:interfaces | |s6.2.1 |AdvValidLifetime |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:prefix-list| | | | |/v6ur:prefix | | | | |/v6ur:control-adv| | | | |-prefixes | | | | |/v6ur:advertise | | | | |/v6ur:valid | | | | |-lifetime | +---------+----------------------+--------------+-----------------+ |4861 |AdvPrefixList/ |ietf-ipv6- |/if:interfaces | |s6.2.1 |AdvOnLinkFlag |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:prefix-list| | | | |/v6ur:prefix | | | | |/v6ur:control-adv| | | | |-prefixes | | | | |/v6ur:advertise/ | | | | |v6ur:on-link-flag| +---------+----------------------+--------------+-----------------+ |4861 |AdvPrefixList/ |ietf-ipv6- |/if:interfaces | |s6.2.1 |AdvPreferredLifetime |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:prefix-list| | | | |/v6ur:prefix | Zhang, et al. Expires 6 May 2027 [Page 25] Internet-Draft ND YANG model November 2026 | | | |/v6ur:control-adv| | | | |-prefixes | | | | |/v6ur:advertise | | | | |/v6ur:preferred | | | | |-lifetime | +---------+----------------------+--------------+-----------------+ |4861 |AdvPrefixList/ |ietf-ipv6- |/if:interfaces | |s6.2.1 |AdvAutonomousFlag |router- |/if:interface | | | |advertisements|/ip:ipv6 | | | | |/v6ur:prefix-list| | | | |/v6ur:prefix | | | | |/v6ur:control-adv| | | | |-prefixes | | | | |/v6ur:advertise | | | | |/v6ur:autonomous | | | | |-flag | +---------+----------------------+--------------+-----------------+ |4861 |LinkMTU |ietf-ip |/if:interfaces | |s6.3.2 | | |/if:interface | | | | |/ip:ipv6/ip:mtu | +---------+----------------------+--------------+-----------------+ |4861 |CurHopLimit |- |- | |s6.3.2 | | | | +---------+----------------------+--------------+-----------------+ |4861 |BaseReachableTime |ietf-ipv6-nd |/if:interfaces | |s6.3.2 | | |/if:interface | | | | |/ip:ipv6/v6nd:nd | | | | |/v6nd:reachable | | | | |-time | +---------+----------------------+--------------+-----------------+ |4861 |ReachableTime |- |- | |s6.3.2 | | | | +---------+----------------------+--------------+-----------------+ |4861 |RetransTimer |ietf-ipv6-nd |/if:interfaces | |s6.3.2 | | |/if:interface | |/4862 | | |/ip:ipv6/v6nd:nd | |s5.1 | | |/v6nd:retrans | | | | |-timer | +---------+----------------------+--------------+-----------------+ |4861 |Proxy Neighbor |ietf-ipv6-nd |/if:interfaces | |s7.2.8 |Advertisements | |/if:interface | | | | |/ip:ipv6/v6nd:nd | | | | |/v6nd:proxy-na | +---------+----------------------+--------------+-----------------+ |4861 |Redirect |ietf-ipv6-nd |/if:interfaces | |s8 | | |/if:interface | | | | |/ip:ipv6/v6nd:nd | | | | |/v6nd:redirect | Zhang, et al. Expires 6 May 2027 [Page 26] Internet-Draft ND YANG model November 2026 +---------+----------------------+--------------+-----------------+ |4862 |DupAddrDetectTransmits|ietf-ip |/if:interfaces | |s5.1 | | |/if:interface | | | | |/ip:ipv6/ip:dup | | | | |-addr-detect | | | | |-transmits | +---------+----------------------+--------------+-----------------+ |4862 |Creation of Global |ietf-ip |/if:interfaces | |s5.5 |Addresses | |/if:interface | | | | |/ip:ipv6 | | | | |/ip:autoconf | | | | |/ip:create- | | | | |global- | | | | |addresses | +---------+----------------------+--------------+-----------------+ |8981 |Creation of Temporary |ietf-ip |/if:interfaces | |s3.4 |Addresses | |/if:interface | | | | |/ip:ipv6 | | | | |/ip:autoconf | | | | |/ip:create- | | | | |temporary- | | | | |addresses | +---------+----------------------+--------------+-----------------+ |8981 |TEMP_VALID_LIFETIME |ietf-ip |/if:interfaces | |s3.4 | | |/if:interface | | | | |/ip:ipv6 | | | | |/ip:autoconf | | | | |/ip:temporary- | | | | |valid-lifetime | +---------+----------------------+--------------+-----------------+ |8981 |TEMP_PREFERRED_ |ietf-ip |/if:interfaces | |s3.4 |LIFETIME | |/if:interface | | | | |/ip:ipv6 | | | | |/ip:autoconf | | | | |/ip:temporary- | | | | |preferred- | | | | |lifetime | +---------+----------------------+--------------+-----------------+ |7527 |Enhanced Duplicate |ietf-ipv6-nd |/if:interfaces | |s4 |Address Detection | |/if:interface | | | | |/ip:ipv6/v6nd:nd/| | | | |v6nd:enhanced-dad| +---------+----------------------+--------------+-----------------+ |7527 |Automated Resolving |ietf-ipv6-nd |/if:interfaces | |s5 |of Duplicates | |/if:interface | | | | |/ip:ipv6/v6nd:nd/| | | | |v6nd:auto-resolve| +---------+----------------------+--------------+-----------------+ Zhang, et al. Expires 6 May 2027 [Page 27] Internet-Draft ND YANG model November 2026 Table 1: Coverage of IPv6 ND Functions and Parameters in YANG Modules Contributors Bin Han Huawei China Email: hanbin3@huawei.com Authors' Addresses Fan Zhang China Telecom Guangzhou China Email: zhangf52@chinatelecom.cn Yongqing Zhu China Telecom Guangzhou China Email: zhuyq8@chinatelecom.cn Bo Wu Huawei China Email: lana.wubo@huawei.com Jiayuan Hu China Telecom Guangzhou China Email: hujy5@chinatelecom.cn Zhang, et al. Expires 6 May 2027 [Page 28]