Advertising Node Administrative Tags in OSPF
Extracted elements (20)
A new TLV for carrying node administrative tags is placed in the Router Information (RI) LSA because route and path selection functionality applies to both TE and non-TE applications, making RI LSA the appropriate common carrier.
Node administrative tags are intentionally opaque to OSPF and not meant to be extended by future OSPF standards; they are for generic use and do not require IANA registration, allowing operators to define local meanings without protocol standardization overhead.
The tag ordering is explicitly defined to carry no semantics, ensuring all policy operations are commutative and implementations are not dependent on tag order, which prevents interoperability issues arising from different ordering behavior.
If a receiving node does not understand the tag value or does not have a local policy corresponding to the tag, it ignores the specific tag and floods the RI LSA without any change as defined in RFC 7770.
The operational use of node administrative tags is analogous to IS-IS prefix tags (RFC 5130) and BGP communities (RFC 1997); operational discipline and procedures from those mechanisms are also applicable here.
At least one tag MUST be carried if the Node Admin Tag TLV is included in the RI LSA.
Implementations supporting node administrative tags MUST NOT be used to convey attributes of the routing topology or associate tags with changes in network topology or route reachability.
Multiple Node Admin Tag TLVs MAY be added in the same RI LSA or in different instances of the RI LSA as defined in RFC 7770.
On the receiver, when there is a change in the Node Admin Tag TLV or removal/addition of a TLV in any RI LSA instance, implementations MUST take appropriate measures to update their state according to the changed set of tags.
OSPF authentication described in RFC 2328 and RFC 5340 or extended authentication mechanisms described in RFC 7474 or RFC 7166 SHOULD be used in deployments where attackers have access to the physical networks.
Tag values SHOULD NOT be propagated outside the administrative domain to which they apply, as interpretation is specific to the local network operator's domain.
The administrative-tag list within the Node Admin Tag TLV MUST be considered an unordered list; policies MUST NOT be reliant upon the order of the tags.
The administrative tags associated with a node for computation at a receiving node SHOULD be a superset of node administrative tags from all TLVs in all received RI LSA instances in the LSDB advertised by the corresponding OSPF router.
When a receiving node receives an RI LSA that changes the set of tags applicable to any originating node with features depending on node administrative tags, the receiving node MUST repeat any computation or processing based on those administrative tags.
When there is a change or removal of an administrative affiliation, the node MUST re-originate the RI LSA with the latest set of node administrative tags.
The Node Admin Tag TLV (Type 10) is carried within the Router Information (RI) LSA for both OSPFv2 and OSPFv3. It advertises one or more 32-bit integer administrative tags identifying groups of nodes in the OSPF domain.
This specification updates the 'OSPF Router Information (RI) TLVs' registry with the registration of Node Admin Tag TLV = 10.
Advertisement of tag values from one administrative domain into another risks misinterpretation of tag values if the two domains have assigned different meanings to the same values, potentially causing undesirable and unanticipated side effects.
Node administrative tags may carry sensitive information (e.g., geographical location). Since OSPF authentication mechanisms do not provide confidentiality (RFC 2328, RFC 5340), tag values could be leaked to an IGP snooper; confidentiality requires running OSPF over IPsec tunnels or applying IPsec-based security (RFC 4552).
The Node Admin Tag TLV has a 16-bit Type field (value 10), a 16-bit Length field indicating the value portion in octets (must be a multiple of 4), followed by one or more 32-bit Administrative Tag values.