Subject: Re: OSPFv3: Source/dest IP address for virtual link

From: Acee Lindem <[email-masked]>
Date: Wed, 16 Jul 2003 01:11:44 -0400

Hi Mike,

I'm copying Mukesh to assure he sees this and agrees.

Mike Fox wrote:
> The OSPFv3 RFC says to use the first address with the LA-bit set from a
> host's set of intra-area prefix LSAs as the destination address of a
> virtual link.
> Also, draft-ietf-ospf-ospfv3-auth-01.txt says that for the source address a
> host should use its own first address with the LA-bit set from its
> intra-area prefix LSAs.
>
> With hosts possibly originating multiple intra-area prefix LSAs, what's the
> mechanism for choosing which intra-area prefix LSA is first?  We are
> thinking of using the one from the host with the lowest LSID,and if an
> eligible address is not found, continuing the search at the next-highest
> LSID, etc.   We would do the same in picking our virtual link source
> address.

This is how I'd interpret RFC 2740 and the "Authentication/Confidentiality for
OSPFv3" draft.

>
> But even this has problems.  There's no guarantee that LSAs will arrive in
> any order, even if they were sent out consecutively.  Supposed a host with
> a virtual link sends an intra-area prefix LSA with LSID of 1, the virtual
> link neighbor picks the first LA-bit address out of it, then one arrives
> with an LSID of 0 that also has an eligible address in it?    Does the
> virtual link get torn down and then rebuilt with the new address?

Nope - but virtual link endpoint router originating the changed LSA above will
need to modify IPSec rule 2 (as referenced in the "Authentication/Confidentiality
for OSPFv3" draft). Similarly, the virtual link endpoint router
receiving the changed LSA above will need to modify IPSec rules 5 and 6.

>
> Also, what about when addresses disappear because of renumbering or are
> simply removed?  Suppose we choose address A as the virtual link
> destination and then at a later time address A is removed from the LSA
> database?

As above, the intent is that the virtual link endpoint routers will modify
their IPSec rules.

>
> We are considering requiring our customers to configure  source addresses
> for  virtual links.  We would then advertise that address in an intra-area
> prefix LSA whose LSID is 0.

That would be one alternative. However, it seems a bit restrictive and you'd
probably have more checking to do in your configuration.

>
> Mike
> -----------------------------------------------------------------------
> Enterprise Network Solutions
> -----------------------------------------------------------------------
> Research Triangle Park, NC  USA
>

--
Acee