RFC 7987

IS-IS Minimum Remaining Lifetime

📅 published October 2016, from ietf

1. Problem Statement 🫶

okay bestie, so the main character here is the IS-IS Minimum Remaining Lifetime problem 💅. Let's get into it! 🦋

Here's the tea: [ISO10589] defines the format of a Link State PDU (LSP) that has a Remaining Lifetime field 🌸. The originator sets this field based on local config, and then every system decrements it once the entry is stored in their LSP Database (LSPDB), as time passes ⏳. This is what lets all Intermediate Systems (ISs) age out the LSP at roughly the same moment 🫧.

Each LSP also has a checksum field so receiving systems can catch errors that happened during transmission 🔍. [ISO10589] says the checksum is calculated by the originator of the LSP and cannot be modified by other routers 🙅‍♀️. That's why the Remaining Lifetime is deliberately left out of the checksum calculation 🎀. When cryptographic authentication is included in an LSP ([RFC5304] or [RFC5310]), the Remaining Lifetime field is also left out of the hash calculation 🔐. So if the Remaining Lifetime gets corrupted during flooding, nobody can detect it 😭. What happens next depends on how the Remaining Lifetime gets altered 👀.

If the Remaining Lifetime ends up larger than the originator intended, it's honestly fine 🌈. The originator is responsible for refreshing the LSP before it ages out, so a new version gets generated in time and no harm is done ✨.

If the Remaining Lifetime ends up smaller than the originator intended, the LSP may age out prematurely (that is, before the originator refreshes it) 💀. This causes two problems:

The LSP gets purged by an IS when the Remaining Lifetime expires. That causes a temporary loss of reachability to destinations affected by that LSP's content 📉.
Unnecessary LSP flooding happens because of the premature purge and the later regeneration and flooding of a new version by the originator 🌊.

If the corrupted Remaining Lifetime is only a little shorter than what the originator assigned, the damage is also small 🤏. But if it gets really small, things can get serious, especially if whatever is causing the corruption keeps happening, because then the cycle repeats over and over 🙈.

A backwards-compatible solution to this problem is defined in the following sections 🧚.

1.1. Requirements Language 🎀

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 💖

2. Solution 💅

So the problem case is when the Remaining Lifetime gets corrupted and becomes way smaller than it should be 😤. The whole goal of the fix is to stop premature purging 🛡️.

Normally, updates to an LSP (purging included, if it's appropriate) are the originator's job 👑. There's a maximum time between generations of a given LSP. Once that time runs out, the originator has to refresh the LSP (issue a new version with a higher sequence number) even if the contents haven't changed 🔄. [ISO10589] defines maximumLSPGenerationInterval to be sufficiently less than the LSP's maximum lifetime so the new version can be flooded across the whole network before the old one ages out on any IS 🏃‍♀️💨.

[ISO10589] defines two cases where a system other than the originator is allowed to purge an LSP:

The LSP ages out. This should only happen if the originating IS is no longer reachable and so can't update the LSP 📴.
There's a Designated Intermediate System (DIS) change on a LAN. The pseudonode LSPs generated by the previous DIS are no longer required and may be purged by the new DIS 🧹.

In both of these cases, purging isn't needed for the protocol to work correctly 🙅‍♀️. It's just an optimization for clearing stale entries out of the LSPDB 🧽.

When the Remaining Lifetime in a received LSP has been corrupted and is smaller than the Remaining Lifetime at the originating node, the receiving node can end up looking like the originating IS failed to regenerate the LSP before it aged out (case #1 above) 🫠. To stop this from causing trouble, a modest change to how "new" LSPs are stored in the LSPDB is specified ✨.

[ISO10589] Section 7.3.16 defines the rules for deciding whether a received LSP is older, the same, or newer than the copy of that same LSP in the receiver's LSPDB 📋. The key elements are:

Higher sequence numbers are newer.
If sequence numbers are the same, an LSP with a zero Remaining Lifetime (a purged LSP) is newer than the same LSP with a non-zero Remaining Lifetime.
If both the received and local copies of the LSP have a non-zero Remaining Lifetime, they're considered the same even if the Remaining Lifetimes differ.

Section 7.3.15.1.e(1) of [ISO10589] defines the actions to take when an LSP generated by another IS is newer than the local copy and has a non-zero Remaining Lifetime 📬. This document adds one more action:

vi. If the Remaining Lifetime of the new LSP is less than MaxAge, it is set to MaxAge. 🌟

This extra action makes sure that no matter what Remaining Lifetime value comes in, a system other than the originator of an LSP will never purge it until the LSP has existed in the database for at least MaxAge 🥰.

Important bit 🚨: no change is proposed for handling received purged LSPs. The rules in Section 7.3.15.1.b of [ISO10589] still apply, so an LSP received with a zero Remaining Lifetime is still considered newer than a matching LSP with a non-zero Remaining Lifetime 🙌. That means these changes won't cause LSPDB inconsistency among routers in the network 💜.

3. Deployment Considerations 🍓

This section talks about some possible deployment issues for this protocol extension 🧐.

3.1. Inconsistent Values for MaxAge

[ISO10589] defines MaxAge (the maximum value for the Remaining Lifetime in an LSP) as an architectural constant of 20 minutes (1200 seconds) ⏰. In practice though, implementations have let this value be configurable 🛠️. The common reason for making it configurable is to support longer lifetimes than the default, which cuts down on periodic LSP regeneration when the topology hasn't changed 🌿. See the discussion of this point in [RFC3719] 📖. So the MaxAge on the IS that originates an LSP can be higher or lower than the MaxAge on the ISs that receive it 🤷‍♀️.

If the originator's MaxAge is smaller than the receiver's MaxAge, setting the received LSP's Remaining Lifetime to the local MaxAge means it won't be purged prematurely 🎉. But if the receiver's MaxAge is less than the originator's, an LSP can still be purged prematurely when using the extension from the previous section 😬. Implementors of this extension may want to guard against that by making the value the Remaining Lifetime is set to, under the conditions described in the previous section, configurable 🎛️. If they do that, the configured value MUST be greater than or equal to the locally configured value of MaxAge 🫶.

3.2. Reporting Corrupted Lifetime 🔍

okay so reporting when you get an LSP with a possibly corrupt Remaining Lifetime field is actually super useful for spotting problems in the network 🕵️‍♀️ but we really don't want to spam everyone with false alarms 🙅‍♀️ so the following algorithm SHOULD be used to decide whether the Remaining Lifetime in the received LSP is possibly corrupt 💅:

The LSP has passed all acceptance tests as specified in Section 7.3.15.1 of [ISO10589] ✅
The LSP is newer than the copy in the local LSPDB (including the case of not being present in the LSPDB) 🆕
The Remaining Lifetime in the received LSP is less than ZeroAgeLifetime 👀
The adjacency to the neighbor from which the LSP is received has been up for a minimum of ZeroAgeLifetime ⏱️

if all of that checks out, an IS SHOULD generate a CorruptRemainingLifetime event 🚨

ngl, it's not possible to catch every single case of a corrupt Remaining Lifetime with this algorithm 😭 and it's also not possible to promise that every CorruptRemainingLifetime event reported with it is valid 🫠 so as a diagnostic aid, an implementation MAY wish to keep the value of the Remaining Lifetime it received when the LSP was added to the LSPDB 🧠✨

3.3. Impact of Delayed LSP Purging 🗑️

so the extensions in this document may end up keeping an LSP around longer than its original lifetime 🕰️ for that to happen, the originator's scheduled refresh of the LSP has to fail to happen, which basically means the originator is no longer reachable 👻 in that case, its neighbors update their own LSPs to report the loss of connectivity to the originator 📡 [ISO10589] says that LSPs from a node that's unreachable (failing the two-way connectivity check) won't be used 🙅‍♀️ and this applies to ALL information in the set of LSPs from that node, so no sneaky leftovers 💀

keeping stale LSPs has no negative side effects other than needing extra memory for the LSPDB 💾 in networks where a bunch of pathological behaviors are happening together (like LSP corruption and nodes resetting all the time), a lot of stale LSPs could get retained 😵 but honestly, those networks are already compromised 🫠

4. Security Considerations 🔐

this part is serious, bestie, so pay attention 🚨 the rules in this document don't change the ability to inject corrupt LSPs 😤 using authentication as defined in [RFC5304] and [RFC5310] is what stops those LSPs from being intentionally injected 🛡️ and a man-in-the-middle attack that modifies an existing LSP by changing the Remaining Lifetime to a small value can cause premature purges even when cryptographic authentication is in place 😱 the mechanisms defined in this document are what keep that kind of attack from working 🔒💜

5. References 📚

5.1. Normative References

[ISO10589] International Organization for Standardization,
           "Information technology -- Telecommunications and
           information exchange between systems -- Intermediate
           System to Intermediate System intra-domain routeing
           information exchange protocol for use in conjunction with
           the protocol for providing the connectionless-mode network
           service (ISO 8473)", ISO/IEC 10589:2002, Second Edition,
           November 2002.

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <http://www.rfc-editor.org/info/rfc2119>.

[RFC5304]  Li, T. and R. Atkinson, "IS-IS Cryptographic
           Authentication", RFC 5304, DOI 10.17487/RFC5304, October
           2008, <http://www.rfc-editor.org/info/rfc5304>.

[RFC5310]  Bhatia, M., Manral, V., Li, T., Atkinson, R., White, R.,
           and M. Fanto, "IS-IS Generic Cryptographic
           Authentication", RFC 5310, DOI 10.17487/RFC5310, February
           2009, <http://www.rfc-editor.org/info/rfc5310>.

5.2. Informative References

[PROB-STATEMENT]
           Decraene, B. and C. Schmitz, "IS-IS LSP lifetime
           corruption - Problem Statement", Work in Progress,
           draft-decraene-isis-lsp-lifetime-problem-statement-02,
           July 2016.

[RFC3719]  Parker, J., Ed., "Recommendations for Interoperable
           Networks using Intermediate System to Intermediate System
           (IS-IS)", RFC 3719, DOI 10.17487/RFC3719, February 2004,
           <http://www.rfc-editor.org/info/rfc3719>.

Acknowledgements 🙏

big thanks to the problem statement in [PROB-STATEMENT], which is what motivated this work 🫶

Contributors 🎀

the following individual contributed substantially to the content of this document and should be considered a co-author 🌟

Stefano Previdi
Cisco Systems
Email: sprevidi@cisco.com

Authors' Addresses 💌

Les Ginsberg
Cisco Systems
510 McCarthy Blvd.
Milpitas, CA  95035
United States of America

Email: ginsberg@cisco.com


Paul Wells
Cisco Systems
170 W. Tasman Dr.
San Jose, CA  95035
United States of America

Email: pauwells@cisco.com


Bruno Decraene
Orange
44 avenue de la Republique, CS 50010
92326 Chatillon Cedex  92794
France

Email: bruno.decraene@orange.com


Tony Przygienda
Juniper
1137 Innovation Way
Sunnyvale, CA  94089
United States of America

Email: prz@juniper.net


Hannes Gredler
RtBrick Inc.

Email: hannes@rtbrick.com

📦 where this page comes from

ietf: rfc7987 2016-10
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms