idnits 2.17.1 draft-ietf-ospf-ospfv2-hbit-09.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- -- The draft header indicates that this document updates RFC6987, but the abstract doesn't seem to directly say this. It does mention RFC6987 though, so this could be OK. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (September 13, 2019) is 1680 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Downref: Normative reference to an Informational RFC: RFC 6987 == Outdated reference: A later version (-28) exists of draft-ietf-idr-bgp-optimal-route-reflection-19 Summary: 1 error (**), 0 flaws (~~), 2 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 OSPF K. Patel 3 Internet-Draft Arrcus 4 Updates: 6987 (if approved) P. Pillay-Esnault 5 Intended status: Standards Track PPE Consulting 6 Expires: March 16, 2020 M. Bhardwaj 7 S. Bayraktar 8 Cisco Systems 9 September 13, 2019 11 Host Router Support for OSPFv2 12 draft-ietf-ospf-ospfv2-hbit-09 14 Abstract 16 The Open Shortest Path First Version 2 (OSPFv2) does not have a 17 mechanism for a node to repel transit traffic if it is on the 18 shortest path. This document assigns a new bit (Host-bit) in the 19 OSPF Router-LSA bit registry and in the OSPF Router Informational 20 Capability Bits Registry that enables a host router to advertise that 21 it is a non-transit router. It also describes the changes needed to 22 support the Host-bit in the domain. In addition, this document 23 updates OSPF Stub Router Advertisement (RFC6987) to advertise for 24 type-2 External and NSSA LSAs with a high cost in order to repel 25 traffic effectively. 27 Status of This Memo 29 This Internet-Draft is submitted in full conformance with the 30 provisions of BCP 78 and BCP 79. 32 Internet-Drafts are working documents of the Internet Engineering 33 Task Force (IETF). Note that other groups may also distribute 34 working documents as Internet-Drafts. The list of current Internet- 35 Drafts is at https://datatracker.ietf.org/drafts/current/. 37 Internet-Drafts are draft documents valid for a maximum of six months 38 and may be updated, replaced, or obsoleted by other documents at any 39 time. It is inappropriate to use Internet-Drafts as reference 40 material or to cite them other than as "work in progress." 42 This Internet-Draft will expire on March 16, 2020. 44 Copyright Notice 46 Copyright (c) 2019 IETF Trust and the persons identified as the 47 document authors. All rights reserved. 49 This document is subject to BCP 78 and the IETF Trust's Legal 50 Provisions Relating to IETF Documents 51 (https://trustee.ietf.org/license-info) in effect on the date of 52 publication of this document. Please review these documents 53 carefully, as they describe your rights and restrictions with respect 54 to this document. Code Components extracted from this document must 55 include Simplified BSD License text as described in Section 4.e of 56 the Trust Legal Provisions and are provided without warranty as 57 described in the Simplified BSD License. 59 Table of Contents 61 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 62 2. Requirements Language . . . . . . . . . . . . . . . . . . . . 3 63 3. Host-bit Support . . . . . . . . . . . . . . . . . . . . . . 3 64 4. SPF Modifications . . . . . . . . . . . . . . . . . . . . . . 5 65 5. Auto Discovery and Backward Compatibility . . . . . . . . . . 6 66 6. OSPF AS-External-LSAs/NSSA LSAs with Type 2 Metrics . . . . . 7 67 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 68 8. Security Considerations . . . . . . . . . . . . . . . . . . . 8 69 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 8 70 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 71 10.1. Normative References . . . . . . . . . . . . . . . . . . 9 72 10.2. Informative References . . . . . . . . . . . . . . . . . 9 73 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9 75 1. Introduction 77 The OSPFv2 specifies a Shortest Path First (SPF) algorithm that 78 identifies transit vertices based on their adjacencies. Therefore, 79 OSPFv2 does not have a mechanism to prevent traffic transiting a 80 participating node if it is a transit vertex in the only existing or 81 shortest path to the destination. The use of metrics to make the 82 node undesirable can help to repel traffic only if an alternative 83 better route exists. 85 This functionality is particularly useful for a number of use cases: 87 1. To isolate a router to avoid blackhole scenarios when there is a 88 reload and possible long reconvergence times. 90 2. Closet Switches are usually not used for transit traffic but need 91 to participate in the topology. 93 3. Overloaded routers could use such a capability to temporarily 94 repel traffic until they stabilize. 96 4. BGP Route reflectors known as virtual Route Reflectors (vRRs), 97 that are not in the forwarding path but are in central locations 98 such as data centers. Such Route Reflectors typically are used 99 for route distribution and are not capable of forwarding transit 100 traffic. However, they need to learn the OSPF topology to 101 perform SPF computation for optimal routes and reachability 102 resolution for its clients 103 [I-D.ietf-idr-bgp-optimal-route-reflection]. 105 This document describes the Host-bit (H-Bit)functionality that 106 prevents other OSPFv2 routers from using the router for transit 107 traffic in OSPFv2 routing domains. This document defines the Host- 108 bit in the OSPFv2 Router Properties Registry and if the host-bit is 109 set then the calculation of the shortest-path tree for an area, as 110 described in section 16.1 of [RFC2328], is modified by including a 111 new check to verify that transit vertices DO NOT have the host-bit 112 set. 114 2. Requirements Language 116 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 117 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 118 "OPTIONAL" in this document are to be interpreted as described in BCP 119 14 [RFC2119] [RFC8174] when, and only when, they appear in all 120 capitals, as shown here. 122 3. Host-bit Support 124 This document defines a new router-LSA bit known as the Host Bit or 125 the H-bit. An OSPFv2 router advertising a router-LSA with the H-bit 126 set indicates that it MUST NOT be used as a transit router (see 127 section 4) by other OSPFv2 routers in the area supporting the 128 functionality. 130 If the host-bit is NOT set routers MUST act transit routers as 131 described in [RFC2328] ensuring backward compatibility. 133 0 1 2 3 134 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 135 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 136 | LS age | Options | 1 | 137 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 138 | Link State ID | 139 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 140 | Advertising Router | 141 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 142 | LS sequence number | 143 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 144 | LS checksum | length | 145 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 146 |H|0|0|N|W|V|E|B| 0 | # links | 147 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 148 | Link ID | 149 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 150 | Link Data | 151 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 152 | Type | # TOS | metric | 153 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 154 | ... | 155 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 156 | TOS | 0 | TOS metric | 157 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 158 | Link ID | 159 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 160 | Link Data | 161 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 162 | ... | 164 Figure 1 166 Host Bit in Router-LSA 168 0 1 2 3 4 5 6 7 169 +-+-+-+-+-+-+-+-+ 170 |H|0|0|N|W|V|E|B| 171 +-+-+-+-+-+-+-+-+ 173 Host Bit 175 Bit H is the high-order bit of the OSPF as shown above. When set, an 176 OSPFv2 router is a Host (non-transit) router and is incapable of 177 forwarding transit traffic. In this mode, the other OSPFv2 routers 178 in the area MUST NOT use the host router for transit traffic, but use 179 the host router only for its local destinations. 181 An OSPFv2 router originating a router-LSA with the H-bit set MUST 182 advertise all its router links with a link cost of MaxLinkMetric 183 [RFC6987]. This is to increase the applicability of the H-bit to 184 partial deployments where it is the responsibility of the operator to 185 ensure that OSPFv2 routers not supporting the H-bit do not install 186 routes causing routing loops. 188 When the H-bit is set, an Area Border Router (ABR) MUST advertise the 189 same H-bit setting in its self-originated router-LSAs for all 190 attached areas. The consistency of the setting will prevent inter- 191 area traffic transiting through the router by suppressing 192 advertisement of prefixes from other routers in the area in its 193 summary LSAs. Only IPv4 prefixes associated with its local 194 interfaces MUST be advertised in summary LSAs to provide reachability 195 to end hosts attached behind a router with the H-bit set. 197 When the H-bit is set the host router cannot act as an AS Boundary 198 Router (ASBR). Indeed, ASBR are transit routers to prefixes that are 199 typically imported through redistribution of prefixes of other 200 routing protocols. Therefore, non-local IPv4 prefixes, e.g., those 201 exported from other routing protocols, MUST NOT be advertised in AS- 202 external-LSAs for routers acting permanently as a host. However, in 203 use cases such as an overloaded router or a router being gracefully 204 isolated, these routers are only temporarily acting as host routers 205 and therefore SHOULD continue to advertise their External LSAs but 206 ensure that they do not attract traffic. In addition to the 207 procedure described above, temporary host routers advertising type 208 2-metric External LSAs MUST set the metrics to LSInfinity to repel 209 traffic.(see Section 6 of this document). 211 4. SPF Modifications 213 The SPF calculation described in section 16.1 [RFC2328] will be 214 modified to ensure that the routers originating router-LSAs with the 215 H-bit set will not be used for transit traffic. Step 2 is modified 216 as follows: 218 2) Call the vertex just added to the 219 tree vertex V. Examine the LSA 220 associated with vertex V. This is 221 a lookup in the Area A's link state 222 database based on the Vertex ID. If 223 this is a router-LSA, and the H-bit 224 of the router-LSA is set, and 225 vertex V is not the root, then the 226 router should not be used for transit 227 and step (3) should be executed 228 immediately. If this is a router-LSA, 229 and bit V of the router-LSA (see 230 Section A.4.2) is set, set Area A's 231 TransitCapability to TRUE. In any case, 232 each link described by the LSA gives 233 the cost to an adjacent vertex. For 234 each described link, (say it joins 235 vertex V to vertex W): 237 5. Auto Discovery and Backward Compatibility 239 To avoid the possibility of any routing loops due to partial 240 deployment, this document defines a OSPF Router Information (RI) LSA 241 [RFC7770] with and an area flooding scope and a new bit assigned in 242 the OSPF Router Informational Capability Bits Registry. Bit: 244 Bit Capabilities 246 7 Host Router Support capability 248 Auto Discovery via announcement of the Host Support Functional 249 Capability ensures that the H-bit functionality and its associated 250 SPF changes MUST only take effect if all the routers in a given OSPF 251 area support this functionality. 253 In normal operations, there is no guarantee that the RI LSA will 254 reach all routers in an area in a timely manner that may result in 255 rooting loops in partial deployments. For example, in a new router 256 joins an area which previous had only H-bit capable routers with 257 H-bit set then it may take some time for the RI to propagate to all 258 routers. 260 The following recommendations will mitigate transient routing loops: 262 o Implementations are RECOMMENDED to provide a configuration 263 parameter to manually override enforcement of the H-bit 264 functionality in partial deployments where the topology guarantees 265 that OSPFv2 routers not supporting the H-bit do not compute routes 266 resulting in routing loops. 268 o All routers, with the H-bit set, MUST advertise all of the 269 router's non-local links with a metric equal to MaxLinkMetric in 270 its LSAs in order to avoid OSPFv2 (unless last resort) routers not 271 supporting the H-bit from attempting to use it for transit 272 traffic. 274 o All routers supporting H-Bit MUST check all the RI LSAs of nodes 275 in the area before actively running the modified SPF to account 276 for the H-bit in order to verify that all routers are in routing 277 capability. If any router does not have the H-Bit support then 278 all routers in the areas MUST run the normal SPF. 280 o Any router not supporting the H-bit capability is detected (by 281 examination of RI- LSA or RTR LSA in the area database) then all 282 routers in the area MUST revert back to normal operations. 284 6. OSPF AS-External-LSAs/NSSA LSAs with Type 2 Metrics 286 When calculating the path to an OSPF AS-External-LSA or NSSA-LSA with 287 a Type-2 metric, the advertised Type-2 metric is taken as more 288 significant than the OSPF intra-area or inter-area path. Hence, 289 advertising the links with MaxLinkMetric as specified in [RFC6987] 290 does not discourage transit traffic when calculating AS external or 291 NSSA routes with Type-2 metrics. 293 Consequently, OSPF routers implementing [RFC6987] and required to be 294 the last resort transit then they MUST advertise a Type-2 metric of 295 LSInfinity-1 for any self-originated type 2 AS-External-LSAs or NSSA- 296 LSAs. However, in situations, the router needs to repel traffic and 297 acts as a host router then, in addition of the host bit procedure 298 described in this document they MUST advertise a Type-2 metric of 299 LSInfinity for any self-originated type 2 AS-External-LSAs or NSSA- 300 LSAs. 302 7. IANA Considerations 304 This document requests the IANA to assign the 0x80 value to the Host- 305 Bit (H-bit)in the OSPFv2 Router Properties Registry 307 Value Description Reference 309 0x80 Host (H-bit) This Document 311 This document requests the IANA to assign the Bit Number value of 7 312 to the Host Router Support Capability in the OSPF Router 313 Informational Capability Bits Registry. [RFC7770] 315 Bit Number Capability Name Reference 317 7 OSPF Host Router This Document 319 8. Security Considerations 321 This document introduces the H-bit which is a capability that 322 restricts the use of a router for transit except for its local 323 destinations. This is a subset of the operations of a normal router 324 and therefore should not introduce new security considerations beyond 325 those already known in OSPF. The feature, however does introduce the 326 flooding of a capability information that allows discovery and 327 verification that all routers in an area are capable before turning 328 on the feature. In the event that a rogue or buggy router advertises 329 incorrectly its capability there are two possible cases: 331 o The router does not have the capability but sends H-Bit set in its 332 LSAs: In this case, there is a possibility of a routing loop. 333 However this is mitigated by the fact that this router should be 334 avoided anyway. Moreover, the link metrics cost (MaxLinkMetric) 335 of this router will mitigate this situation. In any case, a 336 router advertising the H-bit capability without its links cost 337 equal to MaxLinkMetric may be an indicator that this is a rogue 338 router and to be avoided. 340 o The router has the capability but sends the H-Bit clear in its 341 LSAs: In this case, the router merely prevents support of other 342 H-bit routers in the area and all the routers to run the modified 343 SPF. The impact is also mitigated as other H-Bit routers in the 344 area also advertise MaxLinkMetric cost so they will still be 345 avoided unless they are the last resort path. 347 9. Acknowledgements 349 The authors would like to acknowledge Hasmit Grover for discovery of 350 the limitation in [RFC6987], Acee Lindem, Abhay Roy, David Ward, 351 Burjiz Pithawala and Michael Barnes for their comments. 353 10. References 354 10.1. Normative References 356 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 357 Requirement Levels", BCP 14, RFC 2119, 358 DOI 10.17487/RFC2119, March 1997, 359 . 361 [RFC2328] Moy, J., "OSPF Version 2", STD 54, RFC 2328, 362 DOI 10.17487/RFC2328, April 1998, 363 . 365 [RFC6987] Retana, A., Nguyen, L., Zinin, A., White, R., and D. 366 McPherson, "OSPF Stub Router Advertisement", RFC 6987, 367 DOI 10.17487/RFC6987, September 2013, 368 . 370 [RFC7770] Lindem, A., Ed., Shen, N., Vasseur, JP., Aggarwal, R., and 371 S. Shaffer, "Extensions to OSPF for Advertising Optional 372 Router Capabilities", RFC 7770, DOI 10.17487/RFC7770, 373 February 2016, . 375 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 376 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 377 May 2017, . 379 10.2. Informative References 381 [I-D.ietf-idr-bgp-optimal-route-reflection] 382 Raszuk, R., Cassar, C., Aman, E., Decraene, B., and K. 383 Wang, "BGP Optimal Route Reflection (BGP-ORR)", draft- 384 ietf-idr-bgp-optimal-route-reflection-19 (work in 385 progress), July 2019. 387 Authors' Addresses 389 Keyur Patel 390 Arrcus 392 Email: keyur@arrcus.com 394 Padma Pillay-Esnault 395 PPE Consulting 397 Email: padma.ietf@gmail.com 398 Manish Bhardwaj 399 Cisco Systems 400 170 W. Tasman Drive 401 San Jose, CA 95134 402 USA 404 Email: manbhard@cisco.com 406 Serpil Bayraktar 407 Cisco Systems 408 170 W. Tasman Drive 409 San Jose, CA 95134 410 USA 412 Email: serpil@cisco.com