IS-IS Extended Sequence Number TLV
Extracted elements (23)
LSPs are excluded from the ESN TLV mechanism because the existing IS-IS LSP sequence number in the LSP header (per ISO 10589) already provides effective mitigation of intra-session replay attacks; the ESN mechanism adds value specifically for IIHs and SNPs which lack such built-in protection.
The ESN TLV is considered useful even when group key management protocols are deployed, because manual keying systems will always coexist alongside key management protocol systems, and the TLV prevents replays during periods before key changes take effect.
The ESSN is 64-bit rather than 32-bit to allow encoding as a timestamp (e.g., NTP long format) or as a wrap/boot counter in non-volatile storage, ensuring the strictly increasing property is maintained across cold restarts without key changes.
Using non-volatile storage for the ESSN has a known drawback: if non-volatile storage is lost (hardware repair or upgrade), keys MUST be changed to prevent replay attacks, because the boot count continuity is broken.
Deployment is designed to be backward compatible without a flag day: ISs on a given interface are first configured in 'send' mode, and only after all routers on the interface are in 'send' mode is 'verify' mode enabled. The reverse order applies when disabling ESN support.
ESN TLV maintenance for SNPs is done separately per PDU type (CSNP vs PSNP), per originator, and per link; level information is included in the PDU type for IIH tracking.
A PDU with multiple ESN TLVs is invalid and MUST be discarded on receipt.
For each PDU containing the ESN TLV, the 96-bit combined value (ESSN || PSN) MUST be greater than the most recently received value in a PDU of the same type originated by the same IS.
If a received PDU with the ESN TLV is accepted, the stored value for the corresponding originator and PDU type MUST be updated with the latest value received.
If the 32-bit Packet Sequence Number wraps or the router performs a cold restart, the 64-bit ESSN value MUST be set higher than the previous value to prevent sequence number reuse.
Implementations SHOULD allow configuration of ESN TLV features at each IS-IS link level, and SHOULD allow operators to independently control 'send' and 'verify' modes per link and per node.
Implementations SHOULD use available mechanisms to preserve the strictly increasing property of the 64-bit ESSN across the deployed life of the IS-IS node, including cold restarts.
Once 'verify' mode is set for an interface, all IIH PDUs and SNPs sent on that interface MUST contain the ESN TLV; any such PDU received without an ESN TLV MUST be discarded.
Provisioning of 'verify' mode SHOULD be done in a timely fashion after 'send' mode is enabled, to minimize the attack window during which replay PDUs could be accepted by nodes not yet in 'verify' mode.
The 64-bit ESSN MUST be nonzero and MUST contain a number that is increased whenever it is changed due to any situation (e.g., PSN wrap or cold restart).
The ESN TLV MAY be present only in IIH PDUs and SNPs; it is prohibited in LSPs because normal IS-IS LSP update process already provides timely recovery from LSP replay attacks.
The combined 96-bit value—64-bit ESSN (higher-order) concatenated with 32-bit PSN (lower-order)—forms a monotonically increasing unsigned integer that uniquely identifies each PDU from an originator, preventing replay acceptance.
The ESN TLV is defined exclusively for IIH PDUs and SNPs (both CSNP and PSNP); its use in LSPs is explicitly prohibited. The TLV is optional unless 'verify' mode is enabled on a link.
Two operational modes are defined per link and per level: 'send' mode causes the IS to include the ESN TLV in its own IS-IS PDUs, and 'verify' mode causes the IS to enforce the presence and validity of the ESN TLV in received PDUs from neighbors.
A new codepoint (value 11) named 'ESN TLV' has been assigned in the IANA 'IS-IS TLV Codepoints' registry, with applicability to IIH (yes), LSP (no), SNP (yes), and Purge (no).
The ESN TLV cannot mitigate threats where an adversary interferes by not forwarding packets or by delaying messages (as described in RFC 6862 Section 3.3); some threats from the IS-IS security analysis are also not addressable by this mechanism.
The ESN TLV mitigates replay attacks on IS-IS IIH and SNP PDUs, which can otherwise cause adjacency bouncing, blackholing, and DoS. It is intended to be deployed alongside cryptographic authentication per RFC 5304 and RFC 5310; replay mitigation is only possible when authentication information is also present.
The ESN TLV (code 11) consists of 1-octet Type, 1-octet Length (fixed at 12), and a 12-byte Value field composed of a 64-bit Extended Session Sequence Number (ESSN, high-order bits first) followed by a 32-bit Packet Sequence Number (PSN).