Hiding Transit-Only Networks in OSPF
Extracted elements (20)
In OSPFv2, hiding means prefixes are not installed in routing tables, but IPv4 addresses may still be visible in Router-LSA links and network-LSA Link-State IDs. In OSPFv3, router-LSAs and network-LSAs contain no IPv6 addresses, so addresses are fully hidden.
Transit-only networks are configured with routable IP addresses advertised in LSAs but not needed for data traffic. Hiding them speeds up network convergence and reduces vulnerability to remote attacks by preventing routers from being targeted via these addresses.
Unnumbered point-to-point interfaces in OSPFv2 are already effectively hidden since no host route is generated for them. However, the associated numbered interface (e.g., a loopback) may still need hiding and must be evaluated carefully before suppression, as it may serve as a virtual link endpoint or inter-domain peering point.
Using 255.255.255.255 as the subnet mask in the network-LSA hides the transit-only broadcast network without accidentally hiding access broadcast networks, since the Link State ID is preserved and the two-way connectivity check proceeds normally.
An unupgraded router receiving a network-LSA with mask 255.255.255.255 will install a host route to the DR's interface rather than the subnet route. In a partial-deployment scenario this creates routing black holes, but this is acceptable as it actually helps DRs defend against remote attacks by dropping packets destined for transit-only networks.
For OSPFv3 with multiple Address Families (AF) per RFC 5838, the same hiding mechanism (omitting prefixes from link-LSAs and intra-area-prefix-LSAs) applies to AF-enabled transit-only networks, since the existing LSA types are reused.
If prefix-hiding is configured on an interface, the virtual link endpoint MUST NOT use that interface's IP address as the virtual interface's IP address, as the matching routing table entry must exist to ensure the virtual link's operation.
It is RECOMMENDED that all routers in an area be upgraded at the same time to process the modified network-LSA (with 255.255.255.255 mask) correctly and consistently.
To hide a transit-only broadcast network in OSPFv2, a special subnet mask value of 255.255.255.255 MUST be used in the network-LSA instead of the actual subnet mask.
To hide a transit-only point-to-multipoint network, the Type 3 stub link is omitted from the router-LSA, leaving only the Type 1 point-to-point links for each directly communicable neighbor.
To hide a transit-only point-to-point network in OSPFv2, the Type 3 stub link MUST be omitted from the router-LSA, leaving only the Type 1 point-to-point link describing the neighboring router.
When a router builds an intra-area-prefix-LSA referencing a router-LSA, associated IPv6 address prefixes from transit-only networks MUST also be omitted from the intra-area-prefix-LSA.
When a router receives a network-LSA, it MUST calculate the routing table normally, but if the network mask is 255.255.255.255, the router MUST NOT install the route in the RIB.
When prefix-hiding is configured on the next-hop interface, the next-hop address MUST NOT be advertised as a forwarding address in AS-external-LSAs or NSSA-LSAs, because the hidden prefix's routing table entry would not exist to support SPF calculation.
For a numbered point-to-point network in OSPFv2, a router advertises two link descriptions in its router-LSA: one Type 1 link (point-to-point) describing the neighboring router, and one Type 3 link (stub) describing the assigned IPv4 subnet.
For a point-to-multipoint network, a router's router-LSA contains one Type 1 link per directly communicable neighbor and one Type 3 stub link advertising its interface IPv4 address with mask 255.255.255.255.
In OSPFv3, to hide a transit-only network, IPv6 address prefixes are omitted from the router-LSA. The Designated Router building an intra-area-prefix-LSA referencing that network-LSA will consequently also omit those prefixes.
NBMA transit-only networks are hidden using the same mechanism as broadcast networks (Section 2.2.2): the Designated Router originates a network-LSA with subnet mask 255.255.255.255.
Hiding transit-only networks removes their prefixes from routers' forwarding tables so that even if the address is known, the forwarding information is absent and the destination is unreachable. This reduces the attack surface by preventing remote attacks launched against router interfaces on transit-only networks.
Some LSA information such as the OSPF Router ID cannot be omitted. Even if a Router ID is derived from an IPv4 address, reachability is not guaranteed if the address is hidden from forwarding tables. The mechanism can also be applied to hide non-transit networks, and operators should exercise the same care as with other routing protocol parameters.