3Com S7902E, Руководство по настройке

Страница: 1045 / 2621

1-23
Configuring a legal range of BSR addresses enables filtering of bootstrap messages based on the
address range, thus to prevent a maliciously configured host from masquerading as a BSR. The same
configuration needs to be made on all routers in the PIM-SM domain. The following are typical BSR
spoofing cases and the corresponding preventive measures:
1) Some maliciously configured hosts can forge bootstrap messages to fool routers and change RP
mappings. Such attacks often occur on border routers. Because a BSR is inside the network
whereas hosts are outside the network, you can protect a BSR against attacks from external hosts
by enabling the border routers to perform neighbor checks and RPF checks on bootstrap
messages and discard unwanted messages.
2) When a router in the network is controlled by an attacker or when an illegal router is present in the
network, the attacker can configure this router as a C-BSR and make it win BSR election to control
the right of advertising RP information in the network. After being configured as a C-BSR, a router
automatically floods the network with bootstrap messages. As a bootstrap message has a TTL
value of 1, the whole network will not be affected as long as the neighbor router discards these
bootstrap messages. Therefore, with a legal BSR address range configured on all routers in the
entire network, all these routers will discard bootstrap messages from out of the legal address
range.
The above-mentioned preventive measures can partially protect the security of BSRs in a network.
However, if a legal BSR is controlled by an attacker, the above-mentioned problem will still occur.
Follow these steps to configure a C-BSR:
To do… Use the command… Remarks
Enter system view system-view —
Enter public instance or VPN
instance PIM view pim [ vpn-instance
vpn-instance-name ]
—
Configure an interface as a
C-BSR
c-bsr interface-type
interface-number
[ hash-length
[ priority ] ]
Required
No C-BSRs are configured by
default.
Configure a legal BSR address
range
bsr-policy acl-number
Optional
No restrictions on BSR address
range by default
z
Since a large amount of information needs to be exchanged between a BSR and the other devices
in the PIM-SM domain, a relatively large bandwidth should be provided between the C-BSRs and
the other devices in the PIM-SM domain.
z
For C-BSRs interconnected via a Generic Routing Encapsulation (GRE) tunnel, multicast static
routes need to be configured to ensure that the next hop to a C-BSR is a GRE interface. For more
information about multicast static routes, refer to Multicast Routing and Forwarding Configuration
in the IP Multicast Volume.