■
Configure RSVP MD5 authentication to provide hop-by-hop security.
See “Configuring RSVP MD5 Authentication” on page 283.
■
Configure fast reroute extensions to RSVP-TE to create a bypass tunnel.
See “Configuring RSVP-TE Fast Rerouting with RSVP-TE Bypass Tunnels” on
page 284.
■
Configure RSVP-TE peers to exchange hello messages and establish a hello
adjacency.
See “Configuring RSVP-TE Hello Messages to Determine Peer Reachability” on
page 287.
■
Configure RSVP-TE graceful restart to enable routers to maintain MPLS forwarding
state when a link or node failure occurs.
See “Configuring RSVP-TE Graceful Restart” on page 288.
■
Configure the exchange of RSVP-TE node hellos on all RSVP-TE interfaces.
See “Configuring RSVP-TE Hellos Based on Node IDs” on page 289.
■
Configure the BFD Protocol for RSVP-TE.
See “Configuring the BFD Protocol for RSVP-TE” on page 290.
Configuring RSVP MD5 Authentication
RSVP MD5 authentication provides hop-by-hop security against message spoofing
and replay attacks. When authentication is configured, RSVP embeds an integrity
object within secure cleartext RSVP messages sent between peers. The integrity
object includes a key ID unique to the sender, a message sequence number, and
keyed message digest. These attributes enable verification of both packet content
and sender.
For all potential RSVP peers, you configure the same key on the MPLS neighbor major
interfaces, and then enable RSVP authentication on each of these interfaces. When
you enable RSVP authentication on an interface, RSVP creates a security association
that includes the key, key ID, hash algorithm, and other associated attributes. Each
sender and receiver pair maintains the security association for their shared key.
NOTE:
You must enable authentication on both ends of an RSVP interface to protect
the link. Failure to do so can prevent tunnels through the interface from coming up.
Thereafter, RSVP messages sent by a router through the secured interface include
an integrity object that contains a key ID for the security association and an MD5
message digest of the message contents. To protect against message replay attacks,
the sending interface also places a sequence number in the integrity object. Each
sequence number is a unique, monotonically increasing number.
The secured interface expects each received RSVP message to include an integrity
object. The interface drops all RSVP messages that do not contain the object.
Configuring RSVP MD5 Authentication
■
283
Chapter 3: Configuring MPLS
Содержание JUNOSE
Страница 6: ...vi...
Страница 8: ...viii JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 24: ...xxiv Table of Contents JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 37: ...Part 1 Border Gateway Protocol Configuring BGP Routing on page 3 Border Gateway Protocol 1...
Страница 38: ...2 Border Gateway Protocol JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 234: ...198 Monitoring BGP JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 236: ...200 Multiprotocol Layer Switching JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 298: ...262 Point to Multipoint LSPs Configuration JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 346: ...310 Example Traffic Class Configuration for Differentiated Services JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 535: ...There is no no version See undebug ip mbgp Monitoring BGP MPLS VPNs 499 Chapter 5 Configuring BGP MPLS Applications...
Страница 536: ...500 Monitoring BGP MPLS VPNs JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 538: ...502 Layer 2 Services Over MPLS JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 592: ...556 Multiple ATM Virtual Circuits over a Single Pseudowire Example JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 604: ...568 Virtual Private LAN Service JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 618: ...582 VPLS References JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 642: ...606 VPLS Configuration Example with LDP Signaling JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 674: ...638 Virtual Private Wire Service JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 718: ...682 Monitoring MPLS Forwarding Table for VPWS JUNOSe 11 0 x BGP and MPLS Configuration Guide...
Страница 719: ...Part 6 Index Index on page 685 Index 683...
Страница 720: ...684 Index JUNOSe 11 0 x BGP and MPLS Configuration Guide...