Label Distribution Protocol IGP Auto-configuration for OSPF
Label Distribution Protocol (LDP) Interior Gateway Protocol (IGP) auto-configuration simplifies the procedure
to enable LDP on a set of interfaces used by an IGP instance, such as OSPF. LDP IGP auto-configuration can
be used on a large number of interfaces (for example, when LDP is used for transport in the core) and on
multiple OSPF instances simultaneously.
LDP IGP auto-configuration can also be explicitly disabled on an individual interface basis under LDP using
the
igp auto-config disable
command. This allows LDP to receive all OSPF interfaces minus the ones explicitly
disabled.
See
MPLS Configuration Guide for Cisco NCS 6000 Series Routers
for information on configuring LDP IGP
auto-configuration.
OSPF Authentication Message Digest Management
All OSPF routing protocol exchanges are authenticated and the method used can vary depending on how
authentication is configured. When using cryptographic authentication, the OSPF routing protocol uses the
Message Digest 5 (MD5) authentication algorithm to authenticate packets transmitted between neighbors in
the network. For each OSPF protocol packet, a key is used to generate and verify a message digest that is
appended to the end of the OSPF packet. The message digest is a one-way function of the OSPF protocol
packet and the secret key. Each key is identified by the combination of interface used and the key identification.
An interface may have multiple keys active at any time.
To manage the rollover of keys and enhance MD5 authentication for OSPF, you can configure a container of
keys called a
keychain
with each key comprising the following attributes: generate/accept time, key
identification, and authentication algorithm.
GTSM TTL Security Mechanism for OSPF
OSPF is a link state protocol that requires networking devices to detect topological changes in the network,
flood Link State Advertisement (LSA) updates to neighbors, and quickly converge on a new view of the
topology. However, during the act of receiving LSAs from neighbors, network attacks can occur, because
there are no checks that unicast packets are originating from a neighbor that is one hop away or multiple hops
away over virtual links.
For virtual links, OSPF packets travel multiple hops across the network; hence, the TTL value can be
decremented several times. For these type of links, a minimum TTL value must be allowed and accepted for
multiple-hop packets.
To filter network attacks originating from invalid sources traveling over multiple hops, the Generalized TTL
Security Mechanism (GTSM), RFC 3682, is used to prevent the attacks. GTSM filters link-local addresses
and allows for only one-hop neighbor adjacencies through the configuration of TTL value 255. The TTL value
in the IP header is set to 255 when OSPF packets are originated, and checked on the received OSPF packets
against the default GTSM TTL value 255 or the user configured GTSM TTL value, blocking unauthorized
OSPF packets originated from TTL hops away.
Path Computation Element for OSPFv2
A PCE is an entity (component, application, or network node) that is capable of computing a network path
or route based on a network graph and applying computational constraints.
Routing Configuration Guide for Cisco NCS 6000 Series Routers, IOS XR Release 6.4.x
277
Implementing OSPF
Label Distribution Protocol IGP Auto-configuration for OSPF