404
Configuring a C-BSR
IMPORTANT:
Because the BSR and other devices exchange a large amount of information in the IPv6 BIDIR-PIM
domain, reserve a large bandwidth between the C-BSR and other devices.
A BSR policy enables the router to filter BSR messages by using an ACL that specifies the legal BSR
addresses. Configure a BSR policy to guard against the following BSR spoofing cases:
•
Some maliciously configured hosts can forge BSMs to fool routers and change RP mappings.
Such attacks often occur on border routers.
•
When an attacker controls a router on the network, the attacker can configure the router as a
C-BSR to win the BSR election. Through this router, the attacker controls the advertising of RP
information.
When you configure a C-BSR, follow these restrictions and guidelines:
•
C-BSRs should be configured on routers on the backbone network.
•
You must configure the same BSR policy on all routers in the IPv6 BIDIR-PIM domain. The BSR
policy discards illegal BSR messages, but it partially guards against BSR attacks on the
network. If an attacker controls a legal BSR, the problem still exists.
To configure a C-BSR:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter IPv6 PIM view.
ipv6 pim
[
vpn-instance
vpn-instance-name
]
N/A
3.
Configure a C-BSR.
c-bsr
ipv6-address
[
scope
scope-id
]
[
hash-length
hash-length
|
priority
priority
] *
By default, no C-BSRs exist.
4.
(Optional.) Configure a BSR
policy.
bsr-policy
ipv6-acl-number
By default, no BSR policy exists,
and all bootstrap messages are
regarded as legal.
Configuring an IPv6 PIM domain border
An IPv6 PIM domain border determines the transmission boundary of bootstrap messages.
Bootstrap messages cannot cross the domain border in either direction. A number of PIM domain
border interfaces partition a network into different IPv6 BIDIR-PIM domains.
To configure an IPv6 PIM domain border:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface interface-type
interface-number
N/A
3.
Configure an IPv6 PIM
domain border.
ipv6 pim bsr-boundary
By default, an interface is not an
IPv6 PIM domain border.
Disabling BSM semantic fragmentation
BSM semantic fragmentation enables a BSR to split a BSM into multiple BSM fragments (BSMFs) if
the BSM exceeds the MTU. In this way, a non-BSR router can update the RP-set information for a
group range after receiving all BSMFs for the group range. The loss of one BSMF only affects the
RP-set information of the group ranges that the fragment contains.