ISATAP typically builds its Potential Router List (PRL) by consulting the DNS; hence, in the
OSI model it is a lower-layer protocol that relies on a higher layer. A circularity is avoided by relying on an IPv4 DNS server, which does not rely on IPv6 routing being established; however, some network specialists claim that these violations lead to insufficient protocol robustness. ISATAP carries the same security risks as 6over4: the IPv4 virtual link must be delimited carefully at the network edge, so that external IPv4 hosts cannot pretend to be part of the ISATAP link. That is normally done by ensuring that
proto-41 (
6in4) cannot pass through the
firewall. ==Implementations of ISATAP==