Extensions to OSPF for Advertising Prefix Administrative Tags
Extracted elements (19)
The definition of a 64-bit tag was considered but discarded because there is no strong requirement or use case for it; only 32-bit unsigned integer tags are specified.
Backward compatibility with implementations not supporting this specification is maintained by requiring the existing tag field in OSPFv2/OSPFv3 AS-External-LSA and NSSA-LSA to be used for the first tag, with additional tags carried in the new sub-TLV.
An OSPF router acting as an ABR SHOULD propagate administrative tags when originating summary advertisements into other areas, and when translating NSSA routes to AS External advertisements, unless inhibited by local policy.
An OSPF router supporting this specification MUST be able to advertise and interpret at least one tag for all types of prefixes. It MAY support multiple tags and propagate them between areas.
At least one administrative tag MUST be advertised in the Administrative Tag Sub-TLV; the Length MUST be a multiple of 4 octets.
Each tag SHOULD be treated as an autonomous identifier; the ordering of tags SHOULD NOT change their meaning. When propagating multiple tags between areas, the order of tags MUST be preserved for consistent view across implementations supporting fewer tags.
For configured area ranges, NSSA ranges, and redistributed route aggregations, tags from component routes SHOULD NOT be propagated to the summary. Implementations SHOULD provide a mechanism to configure multiple tags for such summaries.
If the Administrative Tag Sub-TLV Length is 0 or not a multiple of 4 octets, the sub-TLV MUST be ignored, and the reception SHOULD be logged for further analysis (subject to rate-limiting).
When multiple LSAs contribute to an OSPF route (ECMP), the ABR propagating the route MUST associate tags from one of the contributing LSAs and MAY associate tags from multiple contributing LSAs up to the maximum supported. It is RECOMMENDED that tags be added in ascending order of LSA originator Router-ID.
When tags are advertised for AS External or NSSA LSA prefixes, the existing tag in the OSPFv2/OSPFv3 AS-External-LSA and NSSA-LSA encodings MUST be utilized for the first tag; additional tags MAY be advertised using the new Administrative Tag Sub-TLV.
BGP-LS [RFC9552] supports advertising OSPF administrative tags using the BGP-LS IGP Route Tag TLV (TLV 1153), which is used to carry the OSPF Administrative Tags defined in this document.
The Administrative Tag Sub-TLV carries one or more 32-bit unsigned integer administrative tags for OSPF prefixes. It uses a 16-bit Type field, a 16-bit Length field (must be a multiple of 4 octets), and a variable-length Value field of one or more 32-bit tags.
The Administrative Tag Sub-TLV is valid as a sub-TLV of: the Extended Prefix TLV (OSPFv2 Extended Prefix Opaque LSA), the Inter-Area-Prefix TLV, Intra-Area-Prefix TLV, and External-Prefix TLV in OSPFv3 Extended LSAs, and the SRv6 Locator TLV in the SRv6 Locator LSA.
The YANG module 'ietf-ospf-admin-tags' augments the OSPF YANG data model (RFC 9129), the OSPFv3 Extended LSA YANG data model (RFC 9587), and the Routing Management YANG data model (RFC 8349) to support configuration and operational state for prefix administrative tags, including per-interface default and prefix-specific tag configuration.
IANA allocated value 13 in the 'OSPFv2 Extended Prefix TLV Sub-TLVs' registry for 'Administrative Tag', value 39 in the 'OSPFv3 Extended-LSA Sub-TLVs' registry for 'Administrative Tag' (L2BM field = 'X'), and value 6 in the 'OSPFv3 SRv6 Locator LSA Sub-TLVs' registry for 'Administrative Tag'.
IANA assigned a new URI 'urn:ietf:params:xml:ns:yang:ietf-ospf-admin-tags' in the IETF XML Registry and registered the YANG module name 'ietf-ospf-admin-tags' in the YANG Module Names registry.
If an attacker can modify administrative tags on OSPF routes used for route redistribution policy, affected routes could be prevented from being advertised in required routing domains (denial of service) or advertised into domains where they should not be (routing vulnerability). Administrative tags are generally less critical than core topology information but their security impact depends on their application.
The ietf-ospf-admin-tags YANG module must be accessed via YANG-based management protocols (NETCONF, RESTCONF) using a secure transport layer (SSH, TLS, QUIC) and mutual authentication. NACM (RFC 8341) should restrict write access to sensitive nodes such as local-prefix-admin-tags and area range admin-tags.
The Administrative Tag Sub-TLV Type field is 16 bits set to 13 for the OSPFv2 Extended Prefix TLV Sub-TLVs registry, 39 for the OSPFv3 Extended-LSA Sub-TLVs registry, or 6 for the OSPFv3 SRv6 Locator LSA Sub-TLVs registry. The Length field is 16 bits indicating the value portion length in octets and must be a multiple of 4.