HP MSR2003 Configuration Manual page 110

These preventive measures can partially protect the BSR in a network. However, if an attacker controls a
legal BSR, the problem still exists.
When you configure a C-BSR, reserve a relatively large bandwidth between the C-BSR and the other
devices in the PIM-SM domain.
When C-BSRs connect to other PIM routers through tunnels, static multicast routes must be configured to
make sure the next hop to a C-BSR is a tunnel interface. Otherwise, RPF check is affected. For more
information about static multicast routes, see "Configuring multicast routing and forwarding."
To configure a C-BSR:
Step
1. Enter system view.
2. Enter PIM view.
3. Configure a C-BSR.
4. (Optional.) Configure a legal
BSR address range.
Configuring a PIM domain border
As the administrative core of a PIM-SM domain, the BSR sends the collected RP-set information in the form
of bootstrap messages to all routers in the PIM-SM domain.
A PIM domain border is a bootstrap message boundary. Each BSR has its specific service scope. A
number of PIM domain border interfaces partition a network into different PIM-SM domains. Bootstrap
messages cannot cross a domain border in either direction.
Perform the following configuration on routers that you want to configure as a PIM domain border.
To configure a PIM domain border:
Step
1. Enter system view.
2. Enter interface view.
3. Configure
border.
Disabling the BSM semantic fragmentation function
Generally, a BSR periodically advertises the RP-set information in BSMs within the PIM-SM domain. It
encapsulates a BSM in an IP datagram. When a BSM exceeds the MTU, it is split into multiple BSM
fragments (BSMFs). The loss of a single IP fragment leads to unavailability of the entire message.
Semantic fragmentation of BSMs can solve this issue. When a non-BSR receives a BSMF, it examines the
RP-set information for a multicast group range:
If the RP-set information is carried in one BSMF, the router directly updates the RP-set information for
•
the group range.
Command
system-view
pim [ vpn-instance
vpn-instance-name ]
c-bsr ip-address [ scope
group-address { mask-length |
mask } ] [ hash-length hash-length
| priority priority ] *
bsr-policy acl-number
Command
system-view
interface interface-type
interface-number
a PIM domain
pim bsr-boundary
100
Remarks
N/A
N/A
By default, no C-BSR is configured.
By default, no restrictions are
defined.
Remarks
N/A
N/A
By default, no PIM domain border
is configured.