idnits 2.17.00 (12 Aug 2021) /tmp/idnits18066/draft-ietf-ospf-ospfv2-hbit-10.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (October 24, 2019) is 939 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Downref: Normative reference to an Informational RFC: RFC 6987 == Outdated reference: draft-ietf-idr-bgp-optimal-route-reflection has been published as RFC 9107 Summary: 1 error (**), 0 flaws (~~), 2 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 OSPF K. Patel 3 Internet-Draft Arrcus 4 Updates: 6987 (if approved) P. Pillay-Esnault 5 Intended status: Standards Track PPE Consulting 6 Expires: April 26, 2020 M. Bhardwaj 7 S. Bayraktar 8 Cisco Systems 9 October 24, 2019 11 Host Router Support for OSPFv2 12 draft-ietf-ospf-ospfv2-hbit-10 14 Abstract 16 The Open Shortest Path First Version 2 (OSPFv2) does not have a 17 mechanism for a node to repel transit traffic if it is on the 18 shortest path. This document defines a bit (Host-bit) that enables a 19 router to advertise that it is a non-transit router." It also 20 describes the changes needed to support the H-bit in the domain. In 21 addition, this document updates RFC 6987 to advertise type-2 External 22 and NSSA LSAs with a high cost in order to repel traffic effectively. 24 Status of This Memo 26 This Internet-Draft is submitted in full conformance with the 27 provisions of BCP 78 and BCP 79. 29 Internet-Drafts are working documents of the Internet Engineering 30 Task Force (IETF). Note that other groups may also distribute 31 working documents as Internet-Drafts. The list of current Internet- 32 Drafts is at https://datatracker.ietf.org/drafts/current/. 34 Internet-Drafts are draft documents valid for a maximum of six months 35 and may be updated, replaced, or obsoleted by other documents at any 36 time. It is inappropriate to use Internet-Drafts as reference 37 material or to cite them other than as "work in progress." 39 This Internet-Draft will expire on April 26, 2020. 41 Copyright Notice 43 Copyright (c) 2019 IETF Trust and the persons identified as the 44 document authors. All rights reserved. 46 This document is subject to BCP 78 and the IETF Trust's Legal 47 Provisions Relating to IETF Documents 48 (https://trustee.ietf.org/license-info) in effect on the date of 49 publication of this document. Please review these documents 50 carefully, as they describe your rights and restrictions with respect 51 to this document. Code Components extracted from this document must 52 include Simplified BSD License text as described in Section 4.e of 53 the Trust Legal Provisions and are provided without warranty as 54 described in the Simplified BSD License. 56 Table of Contents 58 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 59 2. Requirements Language . . . . . . . . . . . . . . . . . . . . 3 60 3. Host-bit Support . . . . . . . . . . . . . . . . . . . . . . 3 61 4. SPF Modifications . . . . . . . . . . . . . . . . . . . . . . 5 62 5. Auto Discovery and Backward Compatibility . . . . . . . . . . 6 63 6. OSPF AS-External-LSAs/NSSA LSAs with Type 2 Metrics . . . . . 7 64 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 65 8. Security Considerations . . . . . . . . . . . . . . . . . . . 8 66 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 8 67 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 68 10.1. Normative References . . . . . . . . . . . . . . . . . . 8 69 10.2. Informative References . . . . . . . . . . . . . . . . . 9 70 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9 72 1. Introduction 74 The OSPFv2 specifies a Shortest Path First (SPF) algorithm that 75 identifies transit vertices based on their adjacencies. Therefore, 76 OSPFv2 does not have a mechanism to prevent traffic transiting a 77 participating node if it is a transit vertex in the only existing or 78 shortest path to the destination. The use of metrics to make the 79 node undesirable can help to repel traffic only if an alternative 80 better route exists. 82 This functionality is particularly useful for a number of use cases: 84 1. To isolate a router to avoid blackhole scenarios when there is a 85 reload and possible long reconvergence times. 87 2. Closet Switches are usually not used for transit traffic but need 88 to participate in the topology. 90 3. Overloaded routers could use such a capability to temporarily 91 repel traffic until they stabilize. 93 4. BGP Route reflectors known as virtual Route Reflectors (vRRs), 94 that are not in the forwarding path but are in central locations 95 such as data centers. Such Route Reflectors typically are used 96 for route distribution and are not capable of forwarding transit 97 traffic. However, they need to learn the OSPF topology to 98 perform SPF computation for optimal routes and reachability 99 resolution for its clients 100 [I-D.ietf-idr-bgp-optimal-route-reflection]. 102 This document describes the Host-bit (H-bit) functionality that 103 prevents other OSPFv2 routers from using the host router for transit 104 traffic in OSPFv2 routing domains. If the H-bit is set then the 105 calculation of the shortest-path tree for an area, as described in 106 section 16.1 of [RFC2328], is modified by including a check to verify 107 that transit vertices DO NOT have the H-bit set (see Section 4). 108 Furthermore, in order to repel traffic effectively, [RFC6987] is 109 updated so that type-2 External and NSSA LSAs are advertised with a 110 high cost (see Section 6). 112 2. Requirements Language 114 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 115 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 116 "OPTIONAL" in this document are to be interpreted as described in BCP 117 14 [RFC2119] [RFC8174] when, and only when, they appear in all 118 capitals, as shown here. 120 3. Host-bit Support 122 This document defines a new router-LSA bit known as the Host Bit or 123 the H-bit. An OSPFv2 router advertising a router-LSA with the H-bit 124 set indicates that it MUST NOT be used as a transit router (see 125 Section 4) by other OSPFv2 routers in the area supporting the 126 functionality. 128 If the H-bit is not set then backwards compatibility is achieved as 129 the behavior will be the same as in [RFC2328]. 131 0 1 2 3 132 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 133 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 134 | LS age | Options | 1 | 135 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 136 | Link State ID | 137 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 138 | Advertising Router | 139 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 140 | LS sequence number | 141 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 142 | LS checksum | length | 143 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 144 |H|0|0|N|W|V|E|B| 0 | # links | 145 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 146 | Link ID | 147 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 148 | Link Data | 149 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 150 | Type | # TOS | metric | 151 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 152 | ... | 153 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 154 | TOS | 0 | TOS metric | 155 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 156 | Link ID | 157 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 158 | Link Data | 159 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 160 | ... | 162 Figure 1: OSPF Router-LSA 164 Bit H is the high-order bit of the OSPF flags as shown below. 166 0 1 2 3 4 5 6 7 167 +-+-+-+-+-+-+-+-+ 168 |H|0|0|N|W|V|E|B| 169 +-+-+-+-+-+-+-+-+ 171 Figure 2: OSPF Router-LSA Option bits 173 When the H-bit is set, the OSPFv2 router is a Host (non-transit) 174 router and is incapable of forwarding transit traffic. In this mode, 175 the other OSPFv2 routers in the area MUST NOT use the host router for 176 transit traffic, but may send traffic to its local destinations. 178 An OSPFv2 router originating a router-LSA with the H-bit set MUST 179 advertise all its non-stub links with a link cost of MaxLinkMetric 180 [RFC6987]. 182 When the H-bit is set, an Area Border Router (ABR) MUST advertise the 183 same H-bit setting in its self-originated router-LSAs for all 184 attached areas. The consistency of the setting will prevent inter- 185 area traffic transiting through the router by suppressing 186 advertisement of prefixes from other routers in the area in its 187 summary LSAs. Only IPv4 prefixes associated with its local 188 interfaces MUST be advertised in summary-LSAs to provide reachability 189 to end hosts attached to a router with the H-bit set. 191 When the H-bit is set the host router cannot act as an AS Boundary 192 Router (ASBR). Indeed, ASBR are transit routers to prefixes that are 193 typically imported through redistribution of prefixes from other 194 routing protocols. Therefore, non-local IPv4 prefixes, e.g., those 195 imported from other routing protocols, SHOULD NOT be advertised in 196 AS-external-LSAs if the H-bit is set. Some use cases, such as an 197 overloaded router or a router being gracefully isolated, may benefit 198 from continued advertisement of non-local prefixes. In these cases, 199 the type 2-metric in AS-external-LSAs MUST be set to LSInfinity to 200 repel traffic.(see Section 6 of this document). 202 4. SPF Modifications 204 The SPF calculation described in section 16.1 [RFC2328] will be 205 modified to ensure that the routers originating router-LSAs with the 206 H-bit set will not be used for transit traffic. Step 2 is modified 207 as follows: 209 2) Call the vertex just added to the 210 tree vertex V. Examine the LSA 211 associated with vertex V. This is 212 a lookup in the Area A's link state 213 database based on the Vertex ID. If 214 this is a router-LSA, and the H-bit 215 of the router-LSA is set, and 216 vertex V is not the root, then the 217 router should not be used for transit 218 and step (3) should be executed 219 immediately. If this is a router-LSA, 220 and bit V of the router-LSA (see 221 Section A.4.2) is set, set Area A's 222 TransitCapability to TRUE. In any case, 223 each link described by the LSA gives 224 the cost to an adjacent vertex. For 225 each described link, (say it joins 226 vertex V to vertex W): 228 5. Auto Discovery and Backward Compatibility 230 To reduce the possibility of any routing loops due to partial 231 deployment, this document defines an OSPF Router Information (RI) LSA 232 [RFC7770] capability. The RI LSA MUST be area-scoped. Bit: 234 Bit Capabilities 236 7 Host Router Support capability 238 Table 1: OSPF Router Information LSA Capabilities 240 Auto Discovery via announcement of the Host Router Support Capability 241 ensures that the H-bit functionality and its associated SPF changes 242 MUST only take effect if all the routers in a given OSPF area support 243 this functionality. 245 In normal operation, there is no guarantee that the RI LSA will reach 246 all routers in an area in a timely manner, which may result in 247 forwarding loops in partial deployments. For example, if a new 248 router joins an area, which previously had only H-bit capable routers 249 with H-bit set then it may take some time for the RI to propagate to 250 all routers. 252 The following recommendations will mitigate transient routing loops: 254 o Implementations are RECOMMENDED to provide a configuration 255 parameter to manually override enforcement of the H-bit 256 functionality in partial deployments where the topology guarantees 257 that OSPFv2 routers not supporting the H-bit do not compute routes 258 resulting in routing loops. 260 o All routers, with the H-bit set, MUST advertise all of the 261 router's non-stub links with a metric equal to MaxLinkMetric 262 [RFC6987] in its LSAs in order to avoid OSPFv2 (unless last 263 resort) routers not supporting the H-bit from attempting to use it 264 for transit traffic. 266 o All routers supporting H-Bit MUST check all the RI LSAs of nodes 267 in the area before actively running the modified SPF to account 268 for the H-bit in order to verify that all routers are in routing 269 capability. If any router does not advertise the Host Router 270 Support capability then the SPF Modifications (Section 4) MUST NOT 271 be used in the area. 273 6. OSPF AS-External-LSAs/NSSA LSAs with Type 2 Metrics 275 When calculating the path to an OSPF AS-External-LSA or NSSA-LSA 276 [RFC3101] with a Type-2 metric, the advertised Type-2 metric is taken 277 as more significant than the OSPF intra-area or inter-area path. 278 Hence, advertising the links with MaxLinkMetric as specified in 279 [RFC6987] does not discourage transit traffic when calculating AS 280 external or NSSA routes with Type-2 metrics. 282 Consequently, [RFC6987] is updated so that the Type-2 metric in any 283 self-originated AS-External-LSAs or NSSA-LSAs is advertised as 284 LSInfinity-1 [RFC2328]. If the H-bit is set, then the Type-2 metric 285 MUST be set to LSInfinity. 287 7. IANA Considerations 289 This document requests the IANA to assign the 0x80 value to the Host- 290 Bit (H-bit)in the OSPFv2 Router Properties Registry 292 Value Description Reference 294 0x80 Host (H-bit) This Document 296 This document requests the IANA to assign the Bit Number value of 7 297 to the Host Router Support Capability in the OSPF Router 298 Informational Capability Bits Registry. 300 Bit Number Capability Name Reference 302 7 OSPF Host Router This Document 304 8. Security Considerations 306 This document introduces the H-bit which is a capability that 307 restricts the use of a router for transit, while only its local 308 destinations are reachable. This is a subset of the operations of a 309 normal router and therefore should not introduce new security 310 considerations beyond those already known in OSPF [RFC2328]. The 311 feature, however does introduce the flooding of a capability 312 information that allows discovery and verification that all routers 313 in an area are capable before turning on the feature. In the event 314 that a rogue or buggy router advertises incorrectly its capability 315 there are two possible cases: 317 o The router does not have the capability but sends the H-Bit set in 318 its LSAs: In this case, there is a possibility of a routing loop. 319 However this is mitigated by the fact that this router should be 320 avoided anyway. Moreover, the link metrics cost (MaxLinkMetric) 321 of this router will mitigate this situation. In any case, a 322 router advertising the H-bit capability without its links cost 323 equal to MaxLinkMetric may be an indicator that this is a rogue 324 router and should be avoided. 326 o The router has the capability but sends the H-Bit clear in its 327 LSAs: In this case, the router merely prevents support of other 328 H-bit routers in the area and all the routers to run the modified 329 SPF. The impact is also mitigated as other H-Bit routers in the 330 area also advertise MaxLinkMetric cost so they will still be 331 avoided unless they are the last resort path. 333 9. Acknowledgements 335 The authors would like to acknowledge Hasmit Grover for discovery of 336 the limitation in [RFC6987], Acee Lindem, Abhay Roy, David Ward, 337 Burjiz Pithawala and Michael Barnes for their comments. 339 10. References 341 10.1. Normative References 343 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 344 Requirement Levels", BCP 14, RFC 2119, 345 DOI 10.17487/RFC2119, March 1997, 346 . 348 [RFC2328] Moy, J., "OSPF Version 2", STD 54, RFC 2328, 349 DOI 10.17487/RFC2328, April 1998, 350 . 352 [RFC6987] Retana, A., Nguyen, L., Zinin, A., White, R., and D. 353 McPherson, "OSPF Stub Router Advertisement", RFC 6987, 354 DOI 10.17487/RFC6987, September 2013, 355 . 357 [RFC7770] Lindem, A., Ed., Shen, N., Vasseur, JP., Aggarwal, R., and 358 S. Shaffer, "Extensions to OSPF for Advertising Optional 359 Router Capabilities", RFC 7770, DOI 10.17487/RFC7770, 360 February 2016, . 362 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 363 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 364 May 2017, . 366 10.2. Informative References 368 [I-D.ietf-idr-bgp-optimal-route-reflection] 369 Raszuk, R., Cassar, C., Aman, E., Decraene, B., and K. 370 Wang, "BGP Optimal Route Reflection (BGP-ORR)", draft- 371 ietf-idr-bgp-optimal-route-reflection-19 (work in 372 progress), July 2019. 374 [RFC3101] Murphy, P., "The OSPF Not-So-Stubby Area (NSSA) Option", 375 RFC 3101, DOI 10.17487/RFC3101, January 2003, 376 . 378 Authors' Addresses 380 Keyur Patel 381 Arrcus 383 Email: keyur@arrcus.com 385 Padma Pillay-Esnault 386 PPE Consulting 388 Email: padma.ietf@gmail.com 389 Manish Bhardwaj 390 Cisco Systems 391 170 W. Tasman Drive 392 San Jose, CA 95134 393 USA 395 Email: manbhard@cisco.com 397 Serpil Bayraktar 398 Cisco Systems 399 170 W. Tasman Drive 400 San Jose, CA 95134 401 USA 403 Email: serpil@cisco.com