H3C S5600 Series Operation Manual page 449

value of 1, the whole network will not be affected as long as the neighbor router discards these
bootstrap messages. Therefore, with a legal BSR address range configured on all routers in the
entire network, all these routers will discard bootstrap messages from out of the legal address
range.
The above-mentioned preventive measures can partially protect the security of BSRs in a network.
However, if a legal BSR is controlled by an attacker, the above-mentioned problem will still occur.
Follow these steps to configure a C-BSR:
To do...
Enter system view
Enter PIM view
Configure an interface as a C-BSR
Configure a legal BSR address
range
Only one C-BSR is in effect on a Layer 3 switch at a time and the latest C-BSR configured on another
interface will overwrite the existing one.
Configuring a PIM-SM domain border
As the administrative core of a PIM-SM domain, the BSR sends the collected RP-Set information in the
form of bootstrap messages to all routers in the PIM-SM domain.
A PIM domain border is a bootstrap message boundary. Each BSR has its specific service scope. A
number of PIM domain border interfaces partition a network into different PIM-SM domains. Bootstrap
messages cannot cross a domain border in either direction.
Perform the following configuration on routers that can become a PIM-SM domain border.
Follow these steps to configure a PIM-SM domain border:
To do...
Enter system view
Enter interface view
Configure a PIM-SM domain
border
Use the command...
system-view
pim
c-bsr interface-type
interface-number hash-mask-len
[ priority ]
bsr-policy acl-number
Use the command...
system-view
interface interface-type
interface-number
pim bsr-boundary
4-13
Remarks
—
—
Optional
No C-BSRs are configured by
default. The default priority is 0.
Optional
No restrictions on BSR address
range by default
Remarks
—
—
Optional
By default, no PIM-SM domain
border is configured.