The OSPF Not-So-Stubby Area (NSSA) Option
obsoletes
- rfc-1587 — The OSPF NSSA Option
Extracted elements (25)
It is not recommended that multiple NSSA border routers simultaneously perform Type-7-to-Type-5 translation because doing so unnecessarily increases the OSPF link state database size. The translator election process (using Nt bit and router ID) ensures typically only one border router translates at a time, while still allowing fallback to another if needed.
NSSAs were created because standard OSPF stub areas cannot import AS external routes, forcing networks like BBN Planet's leaf sites to run RIP between border routers rather than including them fully in OSPF. The NSSA option allows limited external route import via Type-7 LSAs while preserving the benefits of stub area topology.
The P-bit policy paradox documents that Type-7 LSAs with the P-bit clear (not intended for domain-wide propagation) can still be installed in NSSA border router routing tables and hijack traffic from other areas into the NSSA. This is an inherent side-effect of the NSSA design, not a bug, and is documented so implementors understand the traffic-forwarding implications.
RFC 3101 is fully backward-compatible with RFC 1587. All differences expand capability without breaking existing behavior, so implementations of RFC 3101 and RFC 1587 will interoperate. The key changes are: optional summary import, refined forwarding address rules, updated translator election to fix a bug when the highest-router-ID translator loses transit connectivity, and defined P-bit default of clear.
A Type-7 LSA MUST NOT be translated into a Type-5 LSA if its P-bit is clear, its forwarding address is 0.0.0.0, or the most specific Type-7 address range that subsumes its network has DoNotAdvertise status.
All NSSA border routers MUST set the E-bit in Type-1 router-LSAs originated into directly attached non-stub areas, even when not currently translating, so that other NSSA border routers can see their ASBR status across the AS transit topology.
An NSSA internal AS boundary router MUST set the P-bit in Type-7 LSAs whose networks it wants advertised into the OSPF domain's full transit topology, and those LSAs must have a valid non-zero forwarding address.
If the N-bit is set in the options field of a Hello packet, the E-bit MUST be clear. A mismatch in the N-bit or E-bit options between neighbors causes the received Hello packet to be dropped.
NSSA border routers MUST originate a default LSA (0.0.0.0/0) into all directly attached NSSAs to support intra-AS and inter-AS routing. The default is advertised as either a Type-3 or Type-7 LSA depending on the ImportSummaries configuration.
The Type-7 default LSA originated by an NSSA border router MUST have the P-bit clear; it is never translated into a Type-5 LSA. A Type-7 default LSA may only be installed by NSSA border routers if and only if its P-bit is set.
Translated Type-5 LSAs MUST copy the non-zero forwarding address from the Type-7 LSA. Only Type-5 LSAs resulting from aggregation of multiple Type-7 LSAs via address ranges may have a forwarding address of 0.0.0.0.
Type-7 LSAs with the P-bit set MUST have a non-zero forwarding address. If a non-zero forwarding address is unavailable and the P-bit is required, the Type-7 LSA MUST NOT be originated into the NSSA.
When an elected translator is deposed, aggregated Type-5 LSAs (from Type-7 address range aggregation) MUST be flushed after TranslatorStabilityInterval expires. Translated Type-5 LSAs (one-to-one translations) are NOT immediately flushed but age out normally to minimize flooding impact.
When an NSSA border router originates both a Type-5 LSA and a Type-7 LSA for the same network, the P-bit MUST be clear in the Type-7 LSA to prevent another NSSA border router from also translating it into a Type-5 LSA.
When ImportSummaries is disabled, the default LSA originated by an NSSA border router into the NSSA MUST be a Type-3 summary-LSA (not a Type-7 LSA), to protect the NSSA from routing intra-AS traffic out of the AS via a Type-7 default LSA from an internal router.
The N-bit is a new option bit that ensures all routers belonging to an NSSA agree on its configuration. When the N-bit is set in Hello packets, the E-bit must be clear; a mismatch causes the Hello packet to be dropped and no adjacency forms.
The Nt bit in router-LSAs signals that a router is an NSSA border router unconditionally translating Type-7 LSAs into Type-5 LSAs (NSSATranslatorRole=Always). Border routers with NSSATranslatorRole=Candidate use others' Nt bits in their router-LSAs to elect the translator: the router with a set Nt bit or the highest router ID wins.
Type-7 address ranges are configured as [address, mask] pairs with a status of Advertise or DoNotAdvertise and an optional external route tag. Multiple Type-7 LSAs matching a range are aggregated into a single Type-5 LSA by the translating NSSA border router.
Type-7 LSAs carry external route information within an NSSA. They are structurally identical to Type-5 LSAs except the link-state type field is 7, they are flooded only within the originating NSSA, and they include a propagate (P) bit that signals an NSSA border router to translate the LSA into a Type-5 LSA.
OSPF mitigates LSA flooding DoS attacks by mandating MinLSInterval (5 seconds minimum between new originations of the same LSA) and MinLSArrival (1 second minimum acceptance rate during flooding). Database overflow from large NSSAs can be mitigated by configuring stub areas, NSSAs, or using the graceful overflow mechanism of RFC 1765.
OSPF's Cryptographic authentication option (using MD5 message digests and a shared secret key) provides significant protection against active attacks on OSPF exchanges including Type-7 LSAs. However, it does not provide confidentiality or protection against traffic analysis, and security depends on key secrecy and correct implementation across all routers.
The NSSATranslatorState for each NSSA border router transitions between 'disabled', 'elected', and 'enabled'. It initializes to disabled; changes to enabled/elected trigger Type-7-to-Type-5 translation; changes back to disabled cease translation. An elected translator remains active for TranslatorStabilityInterval (default 40 seconds) after being deposed before stopping.
The OSPF Options field (present in Hello, DD packets, and all LSAs) is extended with the N/P bit. In Hello packets this is the N-bit (NSSA capability indicator); in Type-7 LSA headers this is the P-bit (propagate/translate flag). The E-bit and N-bit are mutually exclusive: N-bit set requires E-bit clear.
The Router-LSA (Type-1) is extended with the Nt bit in the flags byte, positioned alongside the existing V, E, W, and B bits. When Nt is set, the router is an NSSA border router with NSSATranslatorRole=Always, unconditionally translating Type-7 LSAs into Type-5 LSAs.
The Type-7 LSA packet format mirrors the Type-5 AS-external-LSA format: a standard link-state header with LS type=7, followed by Network Mask (32 bits), per-TOS metric fields with E-bit (1 bit) and TOS/metric, a Forwarding Address (32 bits), and an External Route Tag (32 bits). The Options field in the header carries the N/P bit.