H3C MSR 2600 Configuration Manual page 199

Step
1. Enter system view.
2. Enter interface view.
3. Enable stateless address
autoconfiguration.
After this configuration, the interface automatically generates an IPv6 global unicast address by using
the address prefix in the received RA message and the interface ID. On an IEEE 802 interface (such as
an Ethernet interface or a VLAN interface), the interface ID is generated based on the MAC address of
the interface and is globally unique. An attacker can exploit this rule to identify the sending device easily.
To fix the vulnerability, you can configure the temporary address function. With this function, an IEEE 802
interface generates the following addresses:
• Public IPv6 address—Includes the address prefix in the RA message and a fixed interface ID
generated based on the MAC address of the interface.
Temporary IPv6 address—Includes the address prefix in the RA message and a random interface
•
ID generated through MD5.
You can also configure the interface to preferably use the temporary IPv6 address as the source address
of sent packets. When the valid lifetime of the temporary IPv6 address expires, the interface removes the
address and generates a new one. This function enables the system to send packets with different source
addresses through the same interface. If the temporary IPv6 address cannot be used because of a DAD
conflict, the public IPv6 address is used.
The preferred lifetime and valid lifetime for a temporary IPv6 address are determined as follows:
• The preferred lifetime of a temporary IPv6 address takes the smaller of the following values:
The preferred lifetime of the address prefix in the RA message.
The preferred lifetime configured for temporary IPv6 addresses minus DESYNC_FACTOR (a
random number ranging from 0 to 600 seconds).
The valid lifetime of a temporary IPv6 address takes the smaller of the following values:
•
The valid lifetime of the address prefix.
The valid lifetime configured for temporary IPv6 addresses.
To configure the temporary address function:
Step
1. Enter system view.
2. Enable the system to generate
a temporary IPv6 address.
Command
system-view
interface interface-type
interface-number
ipv6 address auto
Command
system-view
ipv6 temporary-address
[ valid-lifetime preferred-lifetime ]
184
Remarks
N/A
N/A
By default, no IPv6 global unicast
address is configured on an interface.
Using the undo ipv6 address auto
command on an interface removes all
IPv6 global unicast addresses
automatically generated on the
interface.
Remarks
N/A
By default, the system does not
generate any temporary IPv6
address.