HP 5920 series Configuration Manual page 82

In a PIM-SM domain, the BSR collects C-RP information from the received advertisement messages from
the C-RPs, encapsulates the C-RP information in the RP-set information, and distributes the RP-set
information to all routers in the PIM-SM domain. All routers use the same hash algorithm to get an RP for
a specific multicast group.
Configuring a legal BSR address range enables filtering of BSMs based on the address range, thereby
preventing a maliciously configured host from masquerading as a BSR. The same configuration must be
made on all routers in the PIM-SM domain. The following describes the typical BSR spoofing cases and
the corresponding preventive measures:
Some maliciously configured hosts can forge BSMs to fool routers and change RP mappings. Such
•
attacks often occur on border routers. Because a BSR is inside the network whereas hosts are
outside the network, you can protect a BSR against attacks from external hosts by enabling the
border routers to perform neighbor checks and RPF checks on BSMs and to discard unwanted
messages.
• When an attacker controls a router in the network or when an illegal router is present in the network,
the attacker can configure the router as a C-BSR and make it win the BSR election to advertise RP
information in the network. After a router is configured as a C-BSR, it automatically floods the
network with BSMs. Because a BSM has a TTL value of 1, the whole network will not be affected as
long as the neighbor router discards these BSMs. Therefore, with a legal BSR address range
configured on all routers in the network, all these routers can discard BSMs from out of the legal
address range.
These preventive measures can partially protect the BSR in a network. However, if an attacker controls a
legal BSR, the problem still exists.
When you configure a C-BSR, reserve a relatively large bandwidth between the C-BSR and the other
devices in the PIM-SM domain.
When C-BSRs connect to other PIM routers through tunnels, static multicast routes must be configured to
make sure the next hop to a C-BSR is a tunnel interface. Otherwise, RPF check is affected. For more
information about static multicast routes, see
To configure a C-BSR:
Step
1. Enter system view.
2. Enter PIM view.
3. Configure a C-BSR.
4. (Optional.) Configure a legal
BSR address range.
Configuring a PIM domain border
As the administrative core of a PIM-SM domain, the BSR sends the collected RP-set information in the form
of bootstrap messages to all routers in the PIM-SM domain.
A PIM domain border is a bootstrap message boundary. Each BSR has its specific service scope. A
number of PIM domain border interfaces partition a network into different PIM-SM domains. Bootstrap
messages cannot cross a domain border in either direction.
Perform the following configuration on routers that you want to configure as a PIM domain border.
"Configuring multicast routing and
Command
system-view
pim
c-bsr ip-address [ scope
group-address { mask-length |
mask } ] [ hash-length hash-length
| priority priority ] *
bsr-policy acl-number
75
forwarding."
Remarks
N/A
N/A
By default, no C-BSR is configured.
By default, no restrictions are
defined.