Configuring OSPF TTL Security Check and OSPF Graceful Shutdown

When the TTL Security Check feature is enabled, OSPF sends outgoing packets with an IP header Time to Live (TTL) value of 255 and discards incoming packets that have TTL values less than a configurable threshold. Since each router that forwards an IP packet decrements the TTL, packets received via a direct (one-hop) connection will have a value of 255. Packets that cross two hops will have a value of 254, and so on. The receive threshold is configured in terms of the maximum number of hops that a packet may have traveled. The value for this hop-count argument is a number from 1 to 254, with a default of 1.

The TTL Security Check feature may be configured under the OSPF router submode, in which case it applies to all the interfaces on which OSPF runs, or it may be configured on a per-interface basis.

If you currently have OSPF running in your network and want to implement TTL security on an interface-by-interface basis without any network interruptions, use the ip ospf ttl-security command and set the hop-count argument to 254. This setting causes outgoing packets to be sent with a TTL value of 255, but allows any value for input packets. Later, once the router at the other end of the link has had TTL security enabled you can start enforcing the hop limit for the incoming packets by using the same ip ospf ttl-security command with no hop count specified. This process ensure that OSPF packets will not be dropped because of a temporary mismatch in TTL security.

In OSPF, all areas must be connected to a backbone area. If there is a break in backbone continuity, or the backbone is purposefully partitioned, you can establish a virtual link. The virtual link must be configured in both routers. The configuration information in each router consists of the other virtual endpoint (the other area border router [ABR]) and the nonbackbone area that the two routers have in common (called the transit area.) Note that virtual links cannot be configured through stub areas. Sham links are similar to virtual links in many ways, but sham links are used in Layer 3 Multiprotocol Label Switching (MPLS) Virtual Private Network (VPN) networks to connect Provider Edge (PE) routers across the MPLS backbone.

To establish a virtual link or a sham link, use the area virtual-link or area sham-link cost commands, respectively, in router configuration mode. To configure the TTL Security Check feature on a virtual link or a sham link, configure the ttl-security keyword and the hop-count argument in either command. Note that the hop-count argument value is mandatory in this case.

The OSPF Support for TTL Security Check feature provides an effective and easy-to-deploy solution to protect OSPF neighbor sessions from CPU utilization-based attacks. When this feature is enabled, a host cannot attack an OSPF session if the host is not a member of the local or remote OSPF network, or if the host is not directly connected to a network segment between the local and remote OSPF networks. This solution greatly reduces the effectiveness of Denial of Service (DoS) attacks against an OSPF autonomous system.

The OSPF Graceful Shutdown feature provides the ability to temporarily shut down the OSPF protocol in the least disruptive manner and notify its neighbors that it is going away. All traffic that has another path through the network will be directed to that alternate path. A graceful shutdown of the OSPF protocol can be initiated using the shutdown command in router configuration mode.

This feature also provides the ability to shut down OSPF on a specific interface. In this case, OSPF will not advertise the interface or form adjacencies over it; however, all of the OSPF interface configuration will be retained. To initiate a graceful shutdown of an interface, use the ip ospf shutdown command in interface configuration mode.

1.    enable

2.    configure terminal

3.    router ospf process-id

4.    ttl security all-interfaces [ hops hop-count ]

5.    end

1.    enable

2.    configure terminal

3.    interface type number

4.    ip ospf ttl-security [hops hop-count | disable]

5.    end

6.    show ip ospf [process-id] interface [interface type interface-number] [brief] [multicast] [topology topology-name | base}]

7.    show ip ospf neighbor interface-type interface-number [neighbor-id][detail]

8.    show ip ospf [process-id] traffic [interface-type interface-number]

9.    debug ip ospf adj

1.    enable

2.    configure terminal

3.    interface type number

4.    ip ospf shutdown

5.    end

6.    show ip ospf [ process-id ] interface [ interface type interface-number ] [ brief ] [multicast] [topology topology-name | base}]

7.    show ip ospf [ process-id ]