Locator/ID Separation Protocol (LISP) Control Plane
obsoletes
Extracted elements (32)
Map-Resolvers are specified to operate only in non-caching mode. While caching could improve performance, the document notes that cache management issues (staleness, consistency) would need to be resolved before caching could be reliable and practical; caching functionality is explicitly out of scope.
Implementations MUST be prepared to accept LISP control packets when either the source port or destination UDP port is set to 4342, because NATs may alter port number values in transit, so strict port matching would cause interoperability failures in NAT-traversal scenarios.
A Map-Server MUST accept only EID-Prefixes that are pre-configured for each registering ETR. Failure to enforce this check leaves the Mapping System vulnerable to trivial EID-Prefix hijacking attacks.
A Map-Server SHOULD time out and remove an ETR's registration if it has not received a valid Map-Register within the past three minutes. The suggested Map-Register interval is one minute; during 'quick registration' (after restart), up to one message every 20 seconds is allowed for up to five minutes.
After sending a Map-Register, if a Map-Notify is not received within 1 second, the transmitter MUST retransmit with exponential backoff (base 2), up to a maximum backoff interval of 1 minute.
An SMR-invoked Map-Request MUST be sent through the Mapping System, not directly to the ETR. Both the SMR sender and SMR responder MUST rate limit these messages; the RECOMMENDED limit is no more than once every 3 seconds per destination RLOC or EID-Prefix.
For deployments unaware of underlay path MTU restrictions, LISP control message size MUST be limited to 576 bytes for IPv4 or 1280 bytes for IPv6, considering the entire IP packet, per RFC 8085.
If a Map-Reply Record TTL is 0, the receiving ITR MUST immediately remove the entry from its Map-Cache. A value of 0xffffffff allows the recipient to decide locally how long to store the mapping.
Implementations SHOULD use 'HMAC-SHA256-128+HKDF-SHA256' as the Algorithm ID in Map-Register messages and MUST NOT use 'None' or 'HMAC-SHA-1-96-None' as the Algorithm ID in public Internet deployments.
In the inner UDP header of an ECM, port number 4341 MUST NOT be assigned to either the source or destination port. Both inner and outer UDP checksums MUST be non-zero.
LISP control plane messages that include an unrecognized Address Family Identifier (AFI) MUST be dropped and the event MUST be logged.
Map-Replies MUST be rate limited. It is RECOMMENDED that a Map-Reply for the same destination RLOC be sent no more than once every 3 seconds.
Map-Requests MUST be rate limited to 1 per second per EID-Prefix. After 10 retransmits without receiving the corresponding Map-Reply, the sender MUST wait 30 seconds before retrying.
Map-Resolver RLOC addresses MUST be routable on the underlying core network and MUST NOT require LISP EID-to-RLOC resolution to reach, in order to avoid circular dependency.
RLOC-Probe Map-Requests (probe-bit set) MUST NOT be sent inside Encapsulated Control Messages. If a Map-Resolver or Map-Server receives a Map-Request with the probe-bit set, it MUST drop the message.
The Map-Register Nonce MUST be monotonically increasing to protect against replay attacks. A Map-Server MUST track and save in persistent storage the last nonce per ETR xTR-ID/key pair and MUST drop any Map-Register with a nonce not greater than the saved value.
The pre-shared secret used to authenticate Map-Register messages MUST be unique per LISP Site-ID. Implementations MUST implement HMAC-SHA-256-128 and SHOULD implement HMAC-SHA-256-128+HKDF-SHA256.
The UDP checksum MUST be computed and set to non-zero for all LISP control messages sent to or from port 4342. On receipt it MUST be checked, and if it fails the control message MUST be dropped.
When LISP is deployed over the public Internet, LISP-SEC (RFC 9303) MUST be implemented. The S-bit MUST be set in Map-Reply, Map-Register, and Encapsulated Control Messages (ECMs).
When the probe-bit is set in a Map-Reply, the A-bit in each EID-Record MUST be set to 1; otherwise the Map-Reply MUST be silently discarded.
Negative Map-Reply Action Codes (ACT, 3-bit field) tell an ITR why an empty Locator-Set was returned and how to handle the Map-Cache entry: (0) No-Action, (1) Natively-Forward, (2) Send-Map-Request, (3) Drop/No-Reason, (4) Drop/Policy-Denied, (5) Drop/Auth-Failure.
RLOC-Probing uses the probe-bit in Map-Request/Map-Reply to test path reachability of individual Locators. Probes are sent on a jittered timer directly to the RLOC address (not via the Mapping System) and are not encapsulated in ECMs. The ETR returns a Map-Reply with the probe-bit set and SHOULD include current mapping data.
LISP Algorithm ID Numbers registry identifies KDF and MAC algorithm pairs for Map-Register/Notify/Notify-Ack authentication. Mandatory algorithm is HMAC-SHA-256-128; HMAC-SHA-256-128+HKDF-SHA256 is recommended; 'None' and 'HMAC-SHA-1-96-None' MUST NOT be used in public Internet deployments.
LISP Map-Reply EID-Record Action Codes registry defines 6 action codes (0-5) used in the ACT field of Negative Map-Replies: No-Action, Natively-Forward, Send-Map-Request, Drop/No-Reason, Drop/Policy-Denied, Drop/Auth-Failure.
LISP Packet Type Codes registry (IANA, 4-bit values): Reserved=0, Map-Request=1, Map-Reply=2, Map-Register=3, Map-Notify=4, Map-Notify-Ack=5, DDT Map-Referral=6, ECM=8, Shared Extension=15; values 7 and 9-14 are unassigned.
LISP-SEC (RFC 9303) MUST be deployed when LISP operates over the public Internet to address threats cataloged in RFC 7835, including spoofing, mapping system compromise, and man-in-the-middle attacks on EID-to-RLOC mappings.
Map-Register replay attacks are mitigated by a monotonically increasing nonce. A Map-Server must persist the last nonce per ETR/key and reject messages with non-increasing nonces, logging potential replay attempts. If an ETR cannot persist its nonce across restarts, it MUST use a new authentication key when it restarts.
Without verifying that a registering ETR is authorized to claim a given EID-Prefix, the Mapping System is vulnerable to EID-Prefix hijacking, where a malicious node redirects traffic destined for a legitimate site.
The Encapsulated Control Message (Type=8) wraps a LISP control message inside an outer IP/UDP header (RLOC addresses, dest port 4342) and an inner IP/UDP header (EID or RLOC addresses). The S-bit triggers LISP-SEC authentication data; the D-bit requests DDT Map-Referral processing.
The Map-Register message (Type=3) includes flags P, S, I, E, T, a, M; an 8-octet incrementing Nonce; Key ID (8-bit); Algorithm ID (8-bit); variable-length Authentication Data; and one or more EID Records. When the I-bit is set, a 128-bit xTR-ID and 64-bit Site-ID are appended after the final Record.
The Map-Reply message (Type=2) echoes the 64-bit Nonce from the Map-Request and contains one or more Records each with a 32-bit Record TTL (in minutes), Locator Count, EID mask-len, a 3-bit ACT field for negative replies, and a Locator-Set with per-Locator Priority, Weight, M Priority, M Weight, and L/p/R flags.
The Map-Request message (Type=1) carries a 64-bit Nonce, a Source-EID-AFI/address, one or more ITR-RLOC (AFI, Address) pairs with count encoded in the 5-bit IRC field, and one or more EID Records containing EID mask-len, EID-Prefix-AFI, and EID-Prefix.