H3C SOHO IE4300, Справочник по командам

Страница: 967 / 3296

75
Parameters
valid-lifetime
: Specifies the valid lifetime for temporary IPv6 addresses, in the range of 600
to 4294967295 seconds. The default valid lifetime is 604800 seconds (7 days).
preferred-lifetime
: Specifies the preferred lifetime for temporary IPv6 addresses, in the
range of 600 to 4294967295 seconds. The default preferred lifetime is 86400 seconds (1 day).
Usage guidelines
You must enable stateless autoconfiguration before enabling the temporary address feature.
The valid lifetime for temporary IPv6 addresses must be greater than or equal to the preferred
lifetime for temporary IPv6 addresses.
In stateless address autoconfiguration, an interface automatically generates an IPv6 global unicast
address by using the address prefix in the received RA message and the interface ID. On an IEEE
802 interface (such as an Ethernet interface or a VLAN interface), the interface ID is generated
based on the interface's MAC address and is globally unique. An attacker can exploit this rule to
easily identify the sending device.
To fix the vulnerability, you can enable the temporary address feature. An IEEE 802 interface
generates the following addresses:
•
Public IPv6 address —Includes an address prefix in the RA message and a fixed interface ID
generated based on the interface's MAC address.
•
Temporary IPv6 address —Includes an address prefix in the RA message and a random
interface ID generated through MD5.
When the valid lifetime of a temporary IPv6 address expires, the system deletes the address and
generates a new one. This enables the system to send packets with different source addresses
through the same interface. The preferred lifetime and valid lifetime for a temporary IPv6 address
are determined as follows:
•
The preferred lifetime of a temporary IPv6 address takes the smaller of the following values:

The preferred lifetime of the address prefix in the RA message.

The preferred lifetime configured for temporary IPv6 addresses minus DESYNC_FACTOR
(a random number in the range of 0 to 600 seconds).
•
The valid lifetime of a temporary IPv6 address takes the smaller of the following values:

The valid lifetime of the address prefix.

The valid lifetime configured for temporary IPv6 addresses.
Examples
# Enable the system to generate a temporary IPv6 address.
<Sysname> system-view
[Sysname] ipv6 temporary-address
Related commands
ipv6 address auto
ipv6 nd ra prefix
ipv6 prefer temporary-address
ipv6 unreachables enable
Use
ipv6 unreachables enable
to enable sending ICMPv6 destination unreachable
messages.
Use
undo ipv6 unreachables
to disable sending ICMPv6 destination unreachable messages.