C-Bsr - 3Com 5500G-EI Command Reference Manual

Use the
undo bsr-policy
range limit is set and all received messages are taken as legal.
In a PIM SM network using the BSR (bootstrap router) mechanism, every router
can set itself as a C-BSR (candidate BSR) and have the authority to advertise RP
information in the network once it wins the election. To prevent malicious BSR
spoofing in the network, the following two measures need to be taken:
Prevent the router from being spoofed by hosts though faking legal BSR
■
messages to modify RP mapping. BSR messages are of multicast type and their
TTL is 1, so this type of attacks often hits edge routers. Fortunately, BSRs are
inside the network, while the assaulting hosts are outside, therefore neighbor
and RPF checks can be used to stop this type of attacks.
If a router in the network is manipulated by an attacker, or an illegal router is
■
placed on the network, the attacking router may set itself as a C-BSR and try to
win the election and gain the authority to advertise RP information throughout
the network. Since the router configured as a C-BSR propagates BSR messages,
as multicast with a TTL of 1. Then the network cannot be affected as long as
the peer routers do not receive these BSR messages. This is done by configuring
bsr-policy on each router to limit the legal BSR range, for example, only
1.1.1.1/32 and 1.1.1.2/32 can be BSRs, thus the routers cannot receive or
forward BSR messages received from any other source other than these two.
Even legal BSRs cannot contest with them.
Problems may still exist if a legal BSR is attacked, though these two measures can
effectively guarantee high BSR security.
The parameter in the
source
command.
bsr-policy
Related commands:
Example
Configure BSR filtering policy on routers, only 1.1.1.1/32 can be a BSR.
<SW5500>system-view
System View: return to User View with Ctrl+Z
[SW5500]multicast routing-enable
[SW5500]pim
[SW5500-pim]bsr-policy 2000
[SW5500-pim]quit
[SW5500]acl number 2000
[SW5500-acl-basic-2000]rule 0 permit source 1.1.1.1 0

c-bsr

Syntax
nterface-type interface-number hash-mask-len [ priority ]
c-bsr i
undo c-bsr
View
PIM View
command to restore the default setting so that no
command is translated as a BSR address in the
rule
and
acl rule
PIM Configuration Commands 263