142
hosts are outside the network. To protect a BSR against external attacks, you can enable the
border routers to do the following:
{
Perform neighbor checks and RPF checks on BSMs.
{
Discard unwanted messages.
•
When an attacker controls a router on the network, the attacker can configure the router as a
C-BSR to win the BSR election. Through this router, the attacker controls the advertising of RP
information. For security purposes, you can configure a legal BSR address range on all routers
on the network. Therefore, all routers can discard BSMs that are out of the legal address range.
These preventive measures can partially protect the security of BSRs in a network. However, if an
attacker controls a legal BSR, the problem still exists.
When you configure a C-BSR, follow these guidelines:
•
Because a large amount of information needs to be exchanged between a BSR and the other
devices in the PIM-SM domain, provide a relatively large bandwidth between the C-BSRs and
the other devices in the PIM-SM domain.
•
For C-BSRs interconnected through a tunnel, static multicast routes must be configured to
make sure the next hop to a C-BSR is a tunnel interface. For more information about multicast
static routes, see "
Configuring multicast routing and forwarding
To configure a C-BSR:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter public network PIM
view or VPN instance PIM
view.
pim
[
vpn-instance
vpn-instance-name
]
N/A
3.
Configure an interface as a
C-BSR.
c-bsr
interface-type
interface-number
[
hash-length
[
priority
] ]
No C-BSRs are configured by
default.
4.
Configure a legal BSR
address range.
bsr-policy
acl-number
Optional.
No restrictions on BSR address
range by default.
Configuring a PIM domain border
As the administrative core of a PIM-SM domain, the BSR sends the collected RP-set information in
the form of bootstrap messages to all routers in the PIM-SM domain.
A PIM domain border is a bootstrap message boundary. Each BSR has its specific service scope. A
number of PIM domain border interfaces partition a network into different PIM-SM domains.
Bootstrap messages cannot cross a domain border in either direction.
Perform the following configuration on routers that you want to configure as a PIM domain border.
To configure a PIM domain border:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface
interface-type
interface-number
N/A
3.
Configure a PIM domain
border.
pim bsr-boundary
By default, no PIM domain border
is configured.
