1 AS-scope (type 11) Opaque LSA Validation ( draft-bryskin-ospf-lsa-type11-validation-00.txt ) Igor Bryskin (Movaz Networks) : Alex Zinin (Alcatel) : Lou Berger (LabN Consulting, LLC) :

2 Purpose of the document qFix issue in RFC2370 vThere is no way to validate AS-scope (type 11) Opaque LSAs received outside of the LSA originator area qProposed solution reuses the mechanism for validation of AS external route (type 5) LSAs

3 The Problem q[RFC2370] introduces a mechanism for the distribution of application specific information using the OSPF protocol via opaque LSAs. The distribution of opaque LSA could be limited to: vonly immediate neighbors of the originator (LSAs type- 9) vonly OSPF nodes located within the originator's OSPF area (LSAs type-10) vall OSPF nodes within the originator's OSPF domain/AS (LSAs type-11) qThere is no way for OSPF nodes in remote areas to check availability of a type -11 LSA originator vAs there is with AS external route (type-5)

4 Validation of type-5 LSAs qAS external route (type-5) LSAs have also the AS-scope, hence there is a similar problem with their validation qThe problem is addressed via use of area-scope ASBR- summary (type-4) LSAs originated by ABRs for every known ASBR

5 Proposed Solution qApply the same approach used for validation of AS external route (type-5) LSAs as used to validate AS-scope (type-11) opaque LSAs qSome details: vAS-scope opaque LSAs originators must act as ASBRs –To trigger ASBR-summary (type-4) LSAs originated by ABRs (without ABR modification) –Uses current E-bit Set by OSPF nodes that originate AS-scope opaque LSAs In the Options field of Hello packets and LSAs vNode validate received AS-scope (type-11) opaque LSAs via type- 4 LSAs –As with type-5 LSAs, type-11 LSAs only processed if advertising router (ASBR) has a routing table entry

6 Backward Compatibility issues qNone

7 Security Considerations qThe suggested solution reuses the ASBR tracking mechanism that is already employed in basic OSPF for type-5 LSAs. v Applying it to type-11 Opaque LSAs does not create any threats that are not already known for type-5 LSAs.

8 Notes/Next Steps qType-11 Opaque LSAs flooding rules are unchanged qThe suggested solution does not apply for stub-areas qWe propose to make this draft a WG document

9 Thank You