IGP Unreachable Prefix Announcement

Link-state IGP protocols like IS-IS and OSPF are primarily used to distribute routing information between routers belonging to a single Autonomous System (AS) and to calculate the reachability for IPv4 or IPv6 prefixes advertised by the individual nodes inside the AS. Each node advertises the state of its local adjacencies, connected prefixes, capabilities, etc. The collection of these states from all the routers inside the area form a link-state database (LSDB) that describes the topology of the area and holds additional state information about the prefixes, router capabilities, etc. The growth of networks running a link-state routing protocol results in the addition of more state which leads to scalability and convergence challenges. The organization of networks into levels/areas and IGP domains helps limit the scope of link-state information within certain boundaries. However, the state related to prefix reachability often requires propagation across a multi-area/level and/or multi-domain IGP network. Techniques such as summarization have been used traditionally to address the scale challenges associated with advertising prefix state outside of the local area/domain. However, this results in suppression of the individual prefix state that is useful for triggering fast-convergence mechanisms outside of the IGPs - e.g., BGP PIC Edge [I-D.ietf-rtgwg-bgp-pic]. This document defines two new flags in IS-IS and OSPF. These flags, together with the existing protocol mechanisms, provide the support for the necessary functionality. The functionality being described is called Unreachable Prefix Announcement (UPA). Similarly, when an egress router needs to be taken out for maintenance, the traffic is drained from the node before taking it down. This is typically achieved by setting OL-bit together with using max-metric for all prefixes advertised by the node in IS-IS, or by setting max-metric on all-links and prefixes advertised by the node in OSPF. When prefixes from such node are summarized by the ABR/ASBR, nodes outside of the area or domain are unaware of such prefixes becoming unreachable. This document proposes protocol extensions to carry information about such prefixes in a backward compatible manner.

defines the encoding for advertising IPv4 prefixes using 4 octets of metric information. Section 4 specifies: "If a prefix is advertised with a metric larger then MAX_PATH_METRIC (0xFE000000, see paragraph 3.0), this prefix MUST NOT be considered during the normal SPF computation. This allows advertisement of a prefix for purposes other than building the normal IP routing table. " Similarly, defines the encoding for advertising IPv6 prefixes using 4 octets of metric information. Section 2 states: "...if a prefix is advertised with a metric larger than MAX_V6_PATH_METRIC (0xFE000000), this prefix MUST NOT be considered during the normal Shortest Path First (SPF) computation. This will allow advertisement of a prefix for purposes other than building the normal IPv6 routing table." This functionality can be used to advertise a prefix (IPv4 or IPv6) in a manner which indicates that reachability has been lost - and to do so without requiring all nodes in the network to be upgraded to support the functionality.

Existing nodes in a network that do not suport UPA will not use UPAs during the route calculation, but will continue to flood them. This allows flooding of such advertisements to occur without the need to upgrade all nodes in a network. Recognition of the advertisement as UPA is only required on routers which have a use case for this information. Area Border Routers (ABRs), which would be responsible for propagating UPA advertisements into other areas would need to recognize such advertisements. As per the definitions referenced in the preceding section, any prefix advertisement with a metric value greater than 0xFE000000 can be used for purposes other than normal routing calculations. Such an advertisement can be interpreted by the receiver as a UPA. Optionally, an implementation may use local configuration to limit the set of metric values which will be interpreted as UPA. The only restriction is that such values MUST be greater than 0xFE000000. UPA in IS-IS is supported for all IS-IS Sub-TLVs Advertising Prefix Reachability, e.g., SRv6 Locator , Extended IP reachability , MT IP Reach , IPv6 IP Reach , MT IPv6 IP Reach , IPv4 Algorithm Prefix Reachability TLV , and IPv6 Algorithm Prefix Reachability TLV

IS-IS allows propagation of IP prefixes in both directions between level 1 and level 2. For reachable prefixes this is only done if the prefix is reachable in source level - e.g., the prefix needs to be reachable in level 1 to be propagated to level 2 and vice verse. Such requirement of reachability MUST NOT be applied for UPAs, as they are propagating unreachability. IS-IS L1/L2 routers may wish to advertise received UPAs into other areas (upwards and/or downwards). When propagating UPAs the original metric value MUST be preserved. The cost to reach the originator of the received UPA MUST NOT be considered when readvertising the UPA.

Appendix B defines the following architectural constant for OSPF: "LSInfinity The metric value indicating that the destination described by an LSA is unreachable. Used in summary-LSAs and AS-external-LSAs as an alternative to premature aging (see Section 14.1). It is defined to be the 24-bit binary value of all ones: 0xffffff." Appendix B states: "Architectural constants for the OSPF protocol are defined in Appendix B of OSPFV2." indicating that these same constants are applicable to OSPFv3. section 14.1. also describes the usage of LSInfinity as a way to indicate loss of prefix reachability: "Premature aging can also be used when, for example, one of the router's previously advertised external routes is no longer reachable. In this circumstance, the router can flush its AS- external-LSA from the routing domain via premature aging. This procedure is preferable to the alternative, which is to originate a new LSA for the destination specifying a metric of LSInfinity." In addition, NU-bit is defined for OSPFv3 . Prefixes having the NU-bit set in their PrefixOptions field should be ignored by the route calculation. UPA in OSPFv2 is supported for OSPFv2 Summary-LSA , AS-external-LSAs , NSSA AS-external LSA., and OSPFv2 Extended Prefix TLV . UPA in OSPFv3 is supported for Inter-Area-Prefix-LSA , AS-External-LSA , NSSA-LSA , E-Inter-Area-Prefix-LSA , E-AS-External-LSA , E-Type-7-LSA , and SRv6 Locator LSA .

Using the existing mechanism already defined in the standards, as described in previous section, an advertisement of the inter-area or external prefix inside OSPF or OSPFv3 LSA that has the age set to value lower than MaxAge and metic set to LSInfinity can be interpreted by the receiver as a UPA. Existing nodes in a network which receive UPA advertisements will propagate it following existing standard procedures defined by OSPF. OSPF Area Border Routers (ABRs), which would be responsible for propagating UPA advertisements into other areas would need to recognize such advertisements.

Advertising prefix reachability between OSPF areas assumes prefix reachability in a source area. Such requirement of reachability MUST not be applied for UPAs, as they are propagating unreachability. OSPF ABRs may wish to advertise received UPAs into other connected areas. When doing so, the original LSInfinity metric value in UPA MUST be preserved. The cost to reach the originator of the received UPA MUST NOT be considered when readvertising the UPA to connected areas.

UPA MAY be generated by the ABR or ASBR that is performing the summarization, when all of the following conditions are met: - reachability of a prefix that was reachable earlier was lost - a summary address which covers the prefix is being advertised by the ABR/ASBR Implementations are free to limit the UPA generation to specific prefixes, e.g. host prefixes, SRv6 locators, or similar. Such filtering is optional and MAY be controlled via configuration.

In IS-IS a prefix can be advertised with metric higher than 0xFE000000, in OSPF with metric LSInfinity, or in OSPFv3 with NU-bit set in PrefixOptions, for various reasons. Even though in all cases the treatment of such metric, or NU-bit, is specified for IS-IS, OSPF and OSPFv3, having an explicit way to signal that the prefix was advertised in order to signal unreachability is required to distinguish it from other cases where the prefix with such metric is advertised.

Two new bits in the IPv4/IPv6 Extended Reachability Attribute Flags are defined: U-Flag: - Unreachable Prefix Flag (Bit TBD). When set, it indicates that the prefix is unreachable due to the unplanned reason. UP-Flag: - Unreachable Planned Prefix Flag (Bit TBD). When set, it indicates that the prefix is unreachable due to the planned reason, e.g., planned maintenance. The prefix that is advertised with U-Flag or UP-Flag MUST have the metric set to a value larger than 0xFE000000. If the prefix metric is less than or equal 0xFE000000, both of these flags MUST be ignored.

Two new bits in Flags field of the OSPFv2 Extended Prefix TLV are defined: U-Flag: - Unreachable Prefix Flag (Bit TBD). When set, it indicates that the prefix is unreachable due to the unplanned reason. UP-Flag: - Unreachable Planned Prefix Flag (Bit TBD). When set, it indicates that the prefix is unreachable due to the planned reason, e.g., planned maintenance. The prefix that is advertised with U-Flag or UP-Flag MUST have the metric set to a value LSInfinity. If the prefix metric is not equal to LSInfinity, both of these flags MUST be ignored. For default algorithm 0 prefixes with U-Flag or UP-Flag, it is therefore REQUIRED to advertise the unreachable prefix in the base OSPFv2 LSA - e.g., OSPFv2 Summary-LSA , or AS-external-LSAs , or NSSA AS-external LSA .

A new Prefix Attribute Flags sub-TLV is defined as a sub-TLV of the following OSPFv3 TLVs as defined in : Intra-Area Prefix TLV Inter-Area Prefix TLV External Prefix TLV It MUST appear only once in the parent TLV and has the following format:

Type: TBD Length: variable, dependent on the size of the Prefix Attribute Flags. MUST be a multiple of 4 octets. Prefix Attribute Flags: individual bits representing the flags. Bits in Prefix Attribute Flags are defined/sent starting with Bit 0 defined below. Additional bit definitions that may be defined in the future SHOULD be assigned in ascending bit order so as to minimize the number of bits that will need to be transmitted. Undefined bits MUST be transmitted as 0 and MUST be ignored on receipt. Bits that are NOT transmitted MUST be treated as if they are set to 0 on receipt. Two new bits in OSPFv3 Prefix Atribute Flags are defined: U-Flag: - Unreachable Prefix Flag (Bit TBD). When set, it indicates that the prefix became unreachable due to the unplanned reason. UP-Flag: - Unreachable Planned Prefix Flag (Bit TBD). When set, it indicates that the prefix became unreachable due to the planned reason, e.g., planned maintenance. The prefix that is advertised with U-Flag or UP-flag MUST have the metric set to a value LSInfinity. For default algorithm 0 prefixes, the LSInfinity MUST be set in the parent TLV. For IP Algorithm Prefixes , the LSInfinity MUST be set in OSPFv3 IP Algorithm Prefix Reachability sub-TLV. If the prefix metric is not equal to LSInfinity, both of these flags MUST be ignored. The prefix that is advertised with U-Flag or UP-Flag MUST have the NU-bit set in the PrefixOptions of the parent TLV. If the NU-bit in PrefixOptions of the parent TLV is not set, both of these flags MUST be ignored.

The setting of the U-Flag or the UP-Flag signals that the prefix is unreachable. They constitute the UPA signals. Treatment of these flags on the receiver is optional and the usage of them is outside of scope of this document.

The intent of UPA is to provide an event driven signal of the transition of a destination from reachable to unreachable. It is not intended to advertise a persistent state. UPA advertisements should therefore be withdrawn after a modest amount of time, that would provides sufficient time for UPA to be flooded network-wide and acted upon by receiving nodes, but limits the presence of UPA in the network to a short time period. The time the UPA is kept in the network SHOULD also reflect the intended use-case for which the UPA was advertised. As UPA advertisements in IS-IS are advertised in existing Link State PDUs (LSPs) and the unit of flooding in IS-IS is an LSP, it is recommended that, when possible, UPAs are advertised in LSPs dedicated to this type of advertisement. This will minimize the number of LSPs which need to be updated when UPAs are advertised and withdrawn. In OSPF and OSPFv3, each inter-area and external prefix is advertised in it's own LSA, so the above optimisation does not apply to OSPF. It is also recommended that implementations limit the number of UPA advertisements which can be originated at a given time. UPA is not meant to address an area/domain partition. When an area partitions, while multiple ABRs advertise the same summary, each of the ABRs can only reach portion of the summarized prefix. As a result, depending on which ABR the traffic is using to enter a partitioned area, the traffic could be dropped or be delivered to its final destination. UPA does not make the problem of an area partition any worse. In case of an area partition each of the ABRs will generate UPAs for the destinations for which the reachability was lost locally. As the UPA propagates to the nodes outside of a partitioned area, it may result in such nodes picking an alternative egress node for the traffic, if such alternate egress node exists. If such alternate egress node resides outside of a partitioned area, traffic will be restored. If such alternate egress node resides in a partitioned area and is covered by the summary, the trafic will be dropped if it enters a partitioned area via the ABR that can not reach the alternate egress node - resulting in similar behavior as without the UPA. Above is similarly applicable to a domain partition.

Processing of the received UPAs is optional and SHOULD be controlled by the configuration at the receiver. The receiver itself, based on its configuration, decides what the UPA will be used for and what applications, if any, will be notified when UPA is received.

This document adds two new bits in the "IS-IS Bit Values for Prefix Attribute Flags Sub-TLV" registry: Bit #: TBD Description: U-Flag Reference: This document (). Bit #: TDB Description: UP-Flag Reference: This document ().

This document adds two new bits in the "OSPFv2 Extended Prefix TLV Flags" registry: Bit #: TBD Description: U-Flag Reference: This document (). Bit #: TDB Description: UP-Flag Reference: This document ().

This document adds new Sub-TLV in the "OSPFv3 Extended-LSA Sub-TLVs" registry: Value: TBD Description: Prefix Attribute Flags sub-TLV Reference: This document (). The L2BM column is set to X.

This document defines a new "OSPFv3 Extended Prefix TLV Flags" registry under "Open Shortest Path First v3 (OSPFv3) Parameters". This document adds two new bits in the newly defined "OSPFv3 Extended Prefix TLV Flags" registry: Bit #: TBD Description: U-Flag Reference: This document (). Bit #: TDB Description: UP-Flag Reference: This document ().

The use of UPAs introduces the possibility that an attacker could inject a false, but apparently valid, UPA. However, the risk of this occurring is no greater than the risk today of an attacker injecting any other type of false advertisement . The risks can be reduced by the use of existing security extensions as described in and for IS-IS, in [ and for OSPFv2, and in and for OSPFv3.

The authors would like to thank Kamran Raza, Michael MacKenzie and Luay Jalil for their contribution and support of the overall solution proposed in this document.