Requirements for IP Version 4 Routers
obsoletes
updated by
Extracted elements (28)
The Robustness Principle (from Jon Postel) guides all protocol layers: 'Be conservative in what you do, be liberal in what you accept from others.' Router software must be written to handle every conceivable error and assume the network may contain malicious or misbehaving entities.
Unnumbered point-to-point links use the router's 'router-id' (one of its assigned IP addresses) as a proxy address for the unnumbered interface, rather than the 'virtual router' model. This avoids complex inter-router coordination and allows mixed-vendor environments while conserving IP address space.
Routers MUST comply with RFC 1122 host requirements except where explicitly superseded by this document. Any Internet host acting as a router must adhere to both host and router requirements; the router requirements take precedence in case of conflict.
A router MUST decrement the TTL of every forwarded datagram by at least one. If the TTL reaches zero, the datagram MUST be discarded and an ICMP Time Exceeded message sent to the source (unless the datagram was a multicast).
A router MUST NOT originate trailer-encapsulated packets without first verifying that the immediate destination is willing to accept them, and SHOULD NOT agree to originate such packets. Routers MAY receive and forward trailer-encapsulated Ethernet packets.
A router MUST NOT send ICMP error messages in response to: ICMP error messages, datagrams destined to IP broadcast or multicast addresses, datagrams sent as link-layer broadcasts, or datagrams with an invalid source address (0.0.0.0, broadcast, or multicast).
A router MUST send an ICMP Redirect to the source host when it forwards a datagram out the same interface it arrived on and the source is on the same subnet as the better next-hop. The Redirect MUST contain the IP header plus first 8 bytes of the offending datagram.
A router MUST send an ICMP Time Exceeded (code 0, TTL exceeded in transit) when it discards a datagram because the TTL field has reached zero, unless the datagram was an IP multicast.
A router MUST validate the IP header of every datagram it forwards: version must be 4, header length at least 20 bytes, total length consistent with received data, checksum correct, and source/destination addresses valid. Packets failing validation MUST be discarded, with an ICMP error sent when appropriate.
Routers MUST implement BGP (Border Gateway Protocol) for inter-AS routing when connecting to the global Internet, and MUST validate BGP UPDATE messages for correctness before installing routes. BGP authentication SHOULD be used.
Routers MUST implement congestion control by discarding excess packets when queues are full. Routers SHOULD implement fair queuing to avoid starvation and SHOULD NOT drop packets in a way that systematically disadvantages any particular source or protocol.
Routers MUST implement precedence-ordered queue service, giving priority to higher-precedence datagrams when the output queue is full. Routers MUST also support configurable lower-layer precedence mappings and MUST NOT discard higher-precedence traffic in favor of lower-precedence traffic.
Routers MUST implement route filtering to prevent acceptance of routes with invalid or inappropriate address prefixes, including martian prefixes, overly-specific prefixes (host routes that should not be propagated), and routes that violate AS policy.
Routers MUST implement SNMPv1 and the standard MIBs (MIB-II) for network management. Routers SHOULD implement all standard MIB variables relevant to their configuration and SHOULD provide vendor-specific MIBs for additional management information.
Routers MUST implement source address validation (unicast reverse-path forwarding or equivalent) to prevent forwarding of datagrams with spoofed source addresses when such validation is feasible without disrupting legitimate traffic.
Routers MUST NOT forward datagrams with source or destination addresses that are 'martian' — addresses that are clearly invalid in context, such as loopback (127.0.0.0/8), limited broadcast (255.255.255.255), or Class E (240.0.0.0/4) used as source addresses.
Routers MUST NOT loose-source-route or strict-source-route a datagram unless they implement all requirements for doing so, including not forwarding source-routed datagrams to broadcast addresses and generating appropriate ICMP errors when a source-route cannot be satisfied.
Routers MUST support IP fragmentation when the datagram exceeds the outgoing interface MTU, setting the fragment offset and more-fragments bit correctly. Routers MUST NOT fragment datagrams with the Don't Fragment (DF) bit set; instead they MUST send an ICMP Destination Unreachable (fragmentation needed) message to the source.
Routers MUST use the most specific matching route (longest matching network prefix) when forwarding traffic. This is the fundamental forwarding rule under CIDR, where route prefixes may exhibit subset relationships.
Routers SHOULD always treat a route as a network prefix and SHOULD reject configuration and routing information inconsistent with that model, supporting CIDR's aggregation-based forwarding.
Routers SHOULD by default not forward directed broadcast datagrams, as they can be exploited for amplification attacks. Forwarding of directed broadcasts SHOULD be a configurable option that defaults to disabled.
Routers SHOULD implement rate limiting on ICMP error messages to prevent ICMP storms. The rate limit SHOULD be configurable.
The link layer MUST NOT report a Destination Unreachable error to IP solely because there is no ARP cache entry; it SHOULD queue a small number of datagrams while performing ARP and only report unreachable after ARP fails. A router MUST NOT believe any ARP reply claiming a broadcast or multicast address as a host's link-layer address.
The MTU of each logical interface MUST be configurable within the range of legal MTUs for that interface. A router MUST NOT allow an MTU to be set that would permit frames larger than allowed by the link-layer protocol, but SHOULD be willing to receive packets up to the maximum link-layer frame size.
BOOTP Relay Agents allow routers to forward BOOTP/DHCP requests from clients on one subnet to a BOOTP server on another subnet. The relay agent fills in the 'giaddr' field with the interface address and forwards the request; servers use this field to assign appropriate addresses.
Routers MUST provide access control mechanisms to prevent unauthorized access to management functions. Routers SHOULD maintain audit trails of management operations, configuration changes, and security-relevant events. Out-of-band management access SHOULD be provided.
Routing protocol security is critical: unauthenticated routing updates can be used to redirect traffic or cause denial of service. Routers SHOULD use authentication mechanisms provided by each routing protocol (e.g., MD5 authentication in OSPF and BGP) and SHOULD validate the source addresses of routing protocol messages.
When a router interface fails or is disabled, it MUST immediately update its routing tables to reflect the lost connectivity and MUST send appropriate routing protocol updates. When an interface is re-enabled, the router MUST NOT begin forwarding traffic on it until the interface is fully operational and routing has converged.