HP FlexFabric 5950 series Configuration Manual page 414

Configuring a C-BSR
IMPORTANT:
Because the BSR and other devices exchange a large amount of information in the IPv6 BIDIR-PIM
domain, reserve a large bandwidth between the C-BSR and other devices.
A BSR policy enables the router to filter BSR messages by using an ACL that specifies the legal BSR
addresses. Configure a BSR policy to guard against the following BSR spoofing cases:
•
Some maliciously configured hosts can forge BSMs to fool routers and change RP mappings.
Such attacks often occur on border routers.
•
When an attacker controls a router on the network, the attacker can configure the router as a
C-BSR to win the BSR election. Through this router, the attacker controls the advertising of RP
information.
When you configure a C-BSR, follow these restrictions and guidelines:
•
C-BSRs should be configured on routers on the backbone network.
•
You must configure the same BSR policy on all routers in the IPv6 BIDIR-PIM domain. The BSR
policy discards illegal BSR messages, but it partially guards against BSR attacks on the
network. If an attacker controls a legal BSR, the problem still exists.
To configure a C-BSR:
Step
1. Enter system view.
2. Enter IPv6 PIM view.
3. Configure a C-BSR.
4. (Optional.) Configure a BSR
policy.
Configuring an IPv6 PIM domain border
An IPv6 PIM domain border determines the transmission boundary of bootstrap messages.
Bootstrap messages cannot cross the domain border in either direction. A number of PIM domain
border interfaces partition a network into different IPv6 BIDIR-PIM domains.
To configure an IPv6 PIM domain border:
Step
1. Enter system view.
2. Enter interface view.
3. Configure an IPv6 PIM
domain border.
Disabling BSM semantic fragmentation
BSM semantic fragmentation enables a BSR to split a BSM into multiple BSM fragments (BSMFs) if
the BSM exceeds the MTU. In this way, a non-BSR router can update the RP-set information for a
group range after receiving all BSMFs for the group range. The loss of one BSMF only affects the
RP-set information of the group ranges that the fragment contains.
Command
system-view
ipv6 pim
[ vpn-instance vpn-instance-name ]
c-bsr ipv6-address
[ scope scope-id ]
[ hash-length hash-length
| priority priority ] *
bsr-policy ipv6-acl-number
Command
system-view
interface interface-type
interface-number
ipv6 pim bsr-boundary
404
Remarks
N/A
N/A
By default, no C-BSRs exist.
By default, no BSR policy exists,
and all bootstrap messages are
regarded as legal.
Remarks
N/A
N/A
By default, an interface is not an
IPv6 PIM domain border.