RFC 6860
Hiding Transit-Only Networks in OSPF
RFC 6860: Hiding Transit-Only Networks in OSPF 🦋
okay bestie, let's talk about RFC 6860, which is all about hiding transit-only networks in OSPF 💅
- Authors: Y. Yang, A. Retana, and A. Roy, all from Cisco Systems, Inc. 🌸
- Category: Standards Track, so this is an official Internet Standard 🎀
- Date: January 2013
- ISSN: 2070-1721
- Updates: RFC 2328 and RFC 5340 (so it tweaks OSPFv2 and OSPFv3, no cap) 🔥
Abstract ✨
okay so a transit-only network is just a network that connects routers and nothing else 🧚 in OSPF these usually get routable IP addresses that show up in LSAs even though the data traffic doesn't actually need them. and ngl that's giving unnecessary exposure, because remote attacks can be aimed at routers by sending packets to these networks 💀
this RFC shows a way to hide transit-only networks, which speeds up convergence and cuts down on the vulnerability to remote attacks. main character energy 👑
in this doc, "hiding" means the prefixes don't get installed in the routing tables on OSPF routers. with OSPFv2 the IP addresses can still be visible in some cases 👀
this document updates RFCs 2328 and 5340. 🫶
Status of This Memo 🌈
this is an Internet Standards Track document. 💖
it's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. it got public review and was approved for publication by the Internet Engineering Steering Group (IESG). if you want more info on Internet Standards, check Section 2 of RFC 5741 📚
info about the current status of this doc, any errata, and how to give feedback is at http://www.rfc-editor.org/info/rfc6860 🔗
Copyright Notice 🎀
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. 💜
this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. please actually read these, bestie, because they spell out your rights and restrictions for this doc 🙈 and any Code Components pulled out of this document have to include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. they're also provided without warranty, as described in the Simplified BSD License ⚠️
Table of Contents 🍓
1. Introduction ....................................................3
1.1. Requirements Notation ......................................3
2. Hiding IPv4 Transit-Only Networks in OSPFv2 .....................3
2.1. Point-to-Point Networks ....................................3
2.1.1. Advertising Point-to-Point Networks .................4
2.1.2. Hiding Point-to-Point Networks ......................4
2.2. Broadcast Networks .........................................5
2.2.1. Advertising Broadcast Networks ......................5
2.2.2. Hiding Broadcast Networks ...........................5
2.2.2.1. Sending Network-LSA ........................5
2.2.2.2. Receiving Network-LSA ......................6
2.2.2.2.1. Backward Compatibility ..........6
2.3. Non-Broadcast Networks .....................................7
2.3.1. NBMA ................................................7
2.3.2. Point-to-Multipoint .................................7
2.3.2.1. Advertising Point-to-Multipoint Networks ...7
2.3.2.2. Hiding Point-to-Multipoint Networks ........8
3. Hiding IPv6 Transit-Only Networks in OSPFv3 .....................9
3.1. Hiding AF-Enabled Transit-Only Networks in OSPFv3 ..........9
4. Operational Considerations ......................................9
4.1. Forwarding Address ........................................10
4.2. Virtual Links .............................................10
4.3. Unnumbered Interfaces .....................................10
5. Security Considerations ........................................11
6. Acknowledgments ................................................11
7. References .....................................................12
7.1. Normative References ......................................12
7.2. Informative References ....................................121. Introduction ✨
okay so a transit-only network is, once again, a network that connects routers only 🧚 in OSPF these are usually set up with routable IP addresses that get advertised in LSAs even though data traffic doesn't need them. and remote attacks can be launched against routers by sending packets to these transit-only networks, which is not it 💀
this document presents a mechanism to hide transit-only networks. the payoff is faster network convergence and less vulnerability to remote attacks 🔥
hiding transit-only networks will not impact reachability to the end hosts. bestie, the end hosts are still reachable 💖
same definition of "hiding" as before: the prefixes are not installed in the routing tables on OSPF routers. in [OSPFv2], the IPv4 interface addresses are still visible in the Router-LSA links and in the network-LSA Link-State ID (LSID). in [OSPFv3], the router-LSAs and network-LSAs don't contain IPv6 addresses, so they aren't visible at all 🦋
this document updates [OSPFv2] and [OSPFv3] by specifying a mechanism that can be used to hide transit-only networks. 🎀
1.1. Requirements Notation 📚
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [KEYWORD]. these are the official BCP 14 key words, so they're serious business 💅
2. Hiding IPv4 Transit-Only Networks in OSPFv2 🌸
in [OSPFv2], networks are classified as point-to-point, broadcast, or non-broadcast. the next sections go over how each of these OSPF networks gets advertised and how to hide them 🧚
2.1. Point-to-Point Networks 🦋
a point-to-point network joins a single pair of routers. Figure 1 shows a point-to-point network connecting routers RT1 and RT2 ✨
+---+.1 198.51.100.0/30 .2+---+
|RT1|---------------------------|RT2|
+---+ +---+
Figure 1. Physical Point-to-Point Network2.1.1. Advertising Point-to-Point Networks 💖
for each numbered point-to-point network, a router has two link descriptions in its router-LSA. one is a Type 1 link (point-to-point) describing the neighboring router, and the other is a Type 3 link (stub) describing the assigned IPv4 subnet 🎀
here's an example of a router-LSA originated by RT1:
LS age = 0 ;newly (re-)originated
LS type = 1 ;router-LSA
Link State ID = 192.0.2.1 ;RT1's Router ID
Advertising Router = 192.0.2.1 ;RT1's Router ID
#links = 2
Link ID = 192.0.2.2 ;RT2's Router ID
Link Data = 198.51.100.1 ;Interface IP address
Type = 1 ;connects to RT2
Metric = 10
Link ID= 198.51.100.0 ;IP network/subnet number
Link Data = 255.255.255.252 ;Subnet's mask
Type = 3 ;Connects to stub network
Metric = 10the Type 1 link is used for SPF calculation, and the Type 3 link is used to install a route to the corresponding subnet in the Routing Information Base (RIB). it's giving two jobs, one link, one link, no cap 🧠
2.1.2. Hiding Point-to-Point Networks 🙈
to hide a transit-only point-to-point network, the Type 3 link is left out of the router-LSA 🫶
here's an example of a router-LSA originated by RT1, hiding the point-to-point network from Figure 1:
LS age = 0 ;newly (re-)originated
LS type = 1 ;router-LSA
Link State ID = 192.0.2.1 ;RT1's Router ID
Advertising Router = 192.0.2.1 ;RT1's Router ID
#links = 1
Link ID = 192.0.2.2 ;RT2's Router ID
Link Data = 198.51.100.1 ;Interface IP address
Type = 1 ;connects to RT2
Metric = 102.2. Broadcast Networks 🌈
a broadcast network joins many (more than two) routers and supports the capability to address a single physical message to all of the attached routers. Figure 2 shows a broadcast network connecting routers RT3, RT4, and RT5 💜
+---+ +---+
|RT3| |RT4|
+---+ +---+
|.3 198.51.100.0/24 .4|
+-----------------------------+
|.5
+---+
|RT5|
+---+
Figure 2. Broadcast Network2.2.1. Advertising Broadcast Networks ⭐
a Designated Router (DR) describes a broadcast network in a network-LSA. assuming RT3 is elected as the DR in Figure 2, here's an example of the network-LSA originated by RT3:
LS age = 0 ;newly (re)originated
LS type = 2 ;network-LSA
Link State ID = 198.51.100.3 ;IP address of the DR (RT3)
Advertising Router = 192.0.2.3 ;RT3's Router ID
Network Mask = 255.255.255.0
Attached Router = 192.0.2.3 ;RT3's Router ID
Attached Router = 192.0.2.4 ;RT4's Router ID
Attached Router = 192.0.2.5 ;RT5's Router IDOSPF gets the IP network number from the combo of the Link State ID and the network mask. on top of that, the Link State ID is also used for the two-way connectivity check. multitasking queen 👑
2.2.2. Hiding Broadcast Networks 🫧
2.2.2.1. Sending Network-LSA 🍓
a special subnet mask value of 255.255.255.255 MUST be used in the network-LSA to hide a transit-only broadcast network. a broadcast network connects more than routers, and using 255.255.255.255 won't accidentally hide an access broadcast network, which is a huge relief 😭
since the Link State ID doesn't change, the two-way connectivity check proceeds normally 🦋
here's an example of a network-LSA originated by RT3, hiding the broadcast network from Figure 2:
LS age = 0 ;newly (re-)originated
LS type = 2 ;network-LSA
Link State ID = 198.51.100.3 ;IP address of the DR (RT3)
Advertising Router = 192.0.2.3 ;RT3's Router ID
Network Mask = 255.255.255.255 ;special subnet mask
Attached Router = 192.0.2.3 ;RT3's Router ID
Attached Router = 192.0.2.4 ;RT4's Router ID
Attached Router = 192.0.2.5 ;RT5's Router ID2.2.2.2. Receiving Network-LSA 🧚
It is RECOMMENDED that all routers in an area be upgraded at the same time to process the modified network-LSA correctly and consistently. bestie, the whole area should upgrade together so everyone is on the same page 🫶
when a router receives a network-LSA, it MUST calculate the routing table normally [OSPFv2]. however, if the network mask in the network-LSA is 255.255.255.255, the router MUST NOT install the route in the RIB. so the hidden network stays out of the routing table, and it's literally iconic ✨
2.2.2.2.1. Backward Compatibility ✨
Okay bestie, so this is the glow-up for routers that haven't been upgraded yet 🥹. When one of those older routers gets a modified network-LSA (the one from Section 2.2.2.1 💅), it's going to install a host route to the originating DR. Is it ideal? Nope 😭, but it's still way better than the current situation, where the whole subnet is exposed 🫠.
In a partial-deployment scenario, upgraded routers and not-yet-upgraded routers can be hanging out in the same network 🌸. The upgraded ones don't install the host route to the DR's interface, but the old ones do. That mismatch creates routing black holes, which are normally a total no-no 🙈. BUT here, the packets headed for the transit-only networks get dropped somewhere along the way anyway, so those black holes actually help the DRs defend themselves from remote attacks 🛡️. Iconic, honestly.
In summary, the modification of the network-LSA from Section 2.2.2.1 is backward compatible with the current specification of [OSPFv2], even in a partial-deployment scenario 💖.
2.3. Non-Broadcast Networks 🌈
A non-broadcast network joins many (more than two) routers but does NOT support the capability to address a single physical message to all of the attached routers. As mentioned in [OSPFv2], OSPF runs in one of two modes over non-broadcast networks: Non-Broadcast Multi-Access (NBMA) or point-to-multipoint.
2.3.1. NBMA
In NBMA mode, OSPF is basically emulating a broadcast network 🪞: a Designated Router gets elected for the NBMA network, and that Designated Router originates an LSA for the network.
To hide an NBMA transit-only network, OSPF uses the same modification as the one used over the broadcast transit-only network (see Section 2.2.2) 🫶.
2.3.2. Point-to-Multipoint
In point-to-multipoint mode, OSPF treats the non-broadcast network as a collection of point-to-point links 🦋.
Figure 3 shows a non-broadcast network connecting routers RT6, RT7, RT8, and RT9. In this network, all routers can communicate directly, except for routers RT7 and RT8 👀.
+---+ +---+
|RT6| |RT7|
+---+ +---+
|.6 198.51.100.0/24 .7|
+----------------------------+
|.8 .9|
+---+ +---+
|RT8| |RT9|
+---+ +---+
Figure 3. Non-Broadcast Network2.3.2.1. Advertising Point-to-Multipoint Networks
For a point-to-multipoint network, a router has multiple link descriptions in its router-LSA: one Type 1 link (point-to-point) for EACH directly communicable router, plus one Type 3 link (stub) advertising its interface IPv4 address with a subnet mask of 255.255.255.255. Main character energy 👑.
An example of a router-LSA originated by RT7 would look like this 🍓:
LS age = 0 ;newly (re-)originated
LS type = 1 ;router-LSA
Link State ID = 192.0.2.7 ;RT7's Router ID
Advertising Router = 192.0.2.7 ;RT7's Router ID
#links = 3
Link ID = 192.0.2.6 ;RT6's Router ID
Link Data = 198.51.100.7 ;Interface IP address
Type = 1 ;connects to RT6
Metric = 10
Link ID = 192.0.2.9 ;RT9's Router ID
Link Data = 198.51.100.7 ;Interface IP address
Type = 1 ;connects to RT9
Metric = 10
Link ID= 198.51.100.7 ;Interface IP address
Link Data = 255.255.255.255 ;Subnet's mask
Type = 3 ;Connects to stub network
Metric = 02.3.2.2. Hiding Point-to-Multipoint Networks
To hide a transit-only point-to-multipoint network, the Type 3 link gets omitted from the router-LSA 🙈✨.
An example of a router-LSA originated by RT7, hiding the point-to-point network depicted in Figure 3, would look like this:
LS age = 0 ;newly (re-)originated
LS type = 1 ;router-LSA
Link State ID = 192.0.2.7 ;RT7's Router ID
Advertising Router = 192.0.2.7 ;RT7's Router ID
#links = 2
Link ID = 192.0.2.6 ;RT6's Router ID
Link Data = 198.51.100.7 ;Interface IP address
Type = 1 ;connects to RT6
Metric = 10
Link ID = 192.0.2.9 ;RT9's Router ID
Link Data = 198.51.100.7 ;Interface IP address
Type = 1 ;connects to RT9
Metric = 103. Hiding IPv6 Transit-Only Networks in OSPFv3 🧚
In [OSPFv3], addressing semantics have been removed from the OSPF protocol packets and the main LSA types, leaving a network-protocol-independent core 🌸.
More specifically, router-LSAs and network-LSAs no longer contain network addresses. They just express topology information 🗺️. Instead, two new LSA types got introduced: link-LSA and intra-area-prefix-LSA. A link-LSA associates a list of IPv6 addresses to a link and has local-link flooding scope. An intra-area-prefix-LSA either associates a list of IPv6 addresses with a router by referencing a router-LSA, or associates a list of IPv6 addresses with a broadcast/NBMA network by referencing a network-LSA. In that latter case, the prefixes in the link-LSAs from adjacent neighbors get copied into the intra-area-prefix-LSA by the Designated Router 💅.
To hide a transit-only network in [OSPFv3], the IPv6 address prefixes are omitted from the router-LSA. So when a Designated Router builds an intra-area-prefix-LSA referencing a network-LSA, those IPv6 address prefixes get omitted too 🫠.
In addition, when a router builds an intra-area-prefix-LSA that references a router-LSA, the associated IPv6 address prefixes from the transit-only network MUST also be omitted from the intra-area-prefix-LSA 🚫.
3.1. Hiding AF-Enabled Transit-Only Networks in OSPFv3 🌈
[OSPF-AF] supports multiple Address Families (AFs) by mapping each AF to a separate Instance ID and OSPFv3 instance 🧩.
Meanwhile, each prefix advertised in OSPFv3 has a prefix length field [OSPFv3], which makes it possible to advertise prefixes of different lengths in different AFs. The existing LSAs defined in [OSPFv3] are used for prefix advertising, so there's no need to define new LSAs 🙌.
In other words, since link-LSAs and intra-area-prefix-LSAs are still being used, the same mechanism explained in Section 3 can be used to hide those AF-enabled transit-only networks too 🦋.
4. Operational Considerations 🛠️
By getting rid of the ability to reach transit-only networks, the ability to manage those interfaces may get reduced 😬. So in order not to reduce the functionality and capability of the overall network, it is recommended that extensions such as [UNNUMBERED] also be implemented 💜.
Note that the extension defined in [UNNUMBERED] may give the user the IP address of an interface. If that address was hidden, as specified in this document, then even though the address is assigned to the interface, it won't be reachable 🙃.
4.1. Forwarding Address 📬
A non-zero forwarding address can be advertised in AS-external-LSAs and Not-So-Stubby Area LSAs (NSSA-LSAs) [NSSA] to achieve optimal routing to Autonomous System (AS) external routes. The matching routing table entry for the forwarding address must exist to facilitate the SPF calculation 🧮.
In other words, when prefix-hiding is configured on the next-hop interface, the next-hop address MUST NOT be advertised as a forwarding address 🚫.
Consequently, sub-optimal routing to these AS external routes may exist when prefix-hiding is configured 😅.
4.2. Virtual Links 🔗
Virtual links are used to connect physically separate components of the backbone. The virtual link's viability is determined by the existence of an intra-area path between two endpoints. The matching routing table entries of the endpoints must exist to ensure the virtual link's operation 🌐.
In other words, if prefix-hiding is configured on an interface, the virtual link endpoint MUST NOT use that interface's IP address as the virtual interface's IP address 🚫💅.
4.3. Unnumbered Interfaces 🎀
Note that no host route is generated for, and no IP packets can be addressed to, interfaces to unnumbered point-to-point networks [OSPFv2]. In other words, these addresses are already hidden 🫥.
However, for manageability purposes, it may be common practice to manually include the numbered interface (for example, a loopback interface to which the unnumbered interface points) in routing updates. If needed, the numbered interface's address can be hidden by using the mechanisms described in this document, or by simply not advertising it 🧸.
Before deciding to hide (or suppress the advertisement of) a numbered interface, it is very important to consider other uses that interface may have. Examples of common uses may include virtual link endpoint, inter-domain routing peering point, etc. In other words, it may not be possible to hide the address associated to an unnumbered interface due to other applications in the network 🚨.
5. Security Considerations 🚨
One motivation for this document is to reduce vulnerability to remote attacks by hiding transit-only networks. The result should then be that fewer OSPF core networks will be exposed 🛡️.
The mechanisms described above result in reachability information from transit-only networks not being installed in the routers' forwarding tables. The effect is that even if the address of a transit-only network is known, the forwarding information is not present in the routers to reach the destination. Also, in some cases, the address information is completely omitted from the LSA 🙈.
Some information in the LSA (such as the OSPF Router ID) cannot be omitted. Even though the Router ID may be taken from an IPv4 address on the router, the configuration can be easily changed. Note again that having an address doesn't guarantee reachability if the information is hidden from the forwarding tables 💀.
While the steps described in this document are meant to be applied only to transit-only networks, they could be used to hide other networks as well. It is expected that the same care that users put into the configuration of other routing protocol parameters is used in the configuration of this extension. ⚠️
6. Acknowledgments 🎀
The idea of using a special subnet mask to hide broadcast networks in OSPF was originally introduced in the US patent "Apparatus and method to hide transit only multi-access networks in OSPF" (patent number: 7,929,524), by Yi Yang, Alvaro Retana, James Ng, Abhay Roy, Alfred Lindem, Sina Mirtorabi, Timothy Gage, and Khalid Raza 🫶.
The authors would like to thank Acee Lindem, Shraddha Hegde, Rajesh Shetty, Marek Karasek, Michael Barnes, Paul Wells, Adrian Farrel, and Stephen Farrell for their feedback on the document 🌷.
7. References 📚
7.1. Normative References ✨
okay so these are the must-read docs bestie 📚 the ones the spec leans on so hard that you can't skip them 💅
[KEYWORD] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[NSSA] Murphy, P., "The OSPF Not-So-Stubby Area (NSSA)
Option", RFC 3101, January 2003.
[OSPFv2] Moy, J., "OSPF Version 2", STD 54, RFC 2328,
April 1998.
[OSPFv3] Coltun, R., Ferguson, D., Moy, J., and A. Lindem, "OSPF
for IPv6", RFC 5340, July 2008.
[OSPF-AF] Lindem, A., Ed., Mirtorabi, S., Roy, A., Barnes, M.,
and R. Aggarwal, "Support of Address Families in
OSPFv3", RFC 5838, April 2010.7.2. Informative References 🦋
these ones are the extra reading 🤓 helpful to have open but not required to get the vibe
[UNNUMBERED] Atlas, A., Ed., Bonica, R., Ed., Pignataro, C., Ed.,
Shen, N., and JR. Rivers, "Extending ICMP for Interface
and Next-Hop Identification", RFC 5837, April 2010.Authors' Addresses 🎀
the people who wrote this, with their contact info 💖 they're all at Cisco, so the squad is strong 🫶
Yi Yang
Cisco Systems, Inc.
7025 Kit Creek Road
RTP, NC 27709
USA
EMail: yiya@cisco.com
Alvaro Retana
Cisco Systems, Inc.
7025 Kit Creek Road
RTP, NC 27709
USA
EMail: aretana@cisco.com
Abhay Roy
Cisco Systems, Inc.
225 West Tasman Drive
San Jose, CA 95134
USA
EMail: akr@cisco.comand that's the whole doc bestie 🌈 you literally made it through the entire thing, iconic behaviour 👑✨
📦 where this page comes from
- ietf: rfc6860 2013-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms