HP VPN Firewall Appliances Network Management Configuration Guide

613
Because a bootstrap message has a TTL value of 1, the whole network will not be affected as long as the
neighbor router discards these bootstrap messages. Therefore, with a legal BSR address range
configured on all routers in the entire network, all these routers will discard bootstrap messages from out
of the legal address range.
These preventive measures can partially protect the security of BSRs in a network. However, if an attacker
controls a legal BSR, the problem still exists.
Because the BSR and the other devices exchange a large amount of information in the PIM-SM domain,
provide a relatively large bandwidth between the C-BSRs and the other devices.
For C-BSRs interconnected through a GRE tunnel, configure static multicast routes to make sure the next
hop to a C-BSR is a tunnel interface. For more information about static multicast routes, see "Configuring
m
ulticast routing and fo
rwarding."
To configure a C-BSR:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enter public network PIM
view.
pim N/A
3. Configure an interface as
a C-BSR.
c-bsr interface-type
interface-number
[ hash-length [ priority ] ]
No C-BSRs are configured by default.
4. Configure a legal BSR
address range.
bsr-policy acl-number
Optional.
No restrictions on BSR address range by default.
Configuring a PIM domain border
As the administrative core of a PIM-SM domain, the BSR sends the collected RP-set information in the form
of bootstrap messages to all routers in the PIM-SM domain.
A PIM domain border is a bootstrap message boundary. Each BSR has its specific service scope. A
number of PIM domain border interfaces partition a network into different PIM-SM domains. Bootstrap
messages cannot cross a domain border in either direction.
Perform the following configuration on routers that you want to configure as a PIM domain border.
To configure a PIM domain border:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enter interface view.
interface interface-type
interface-number
N/A
3. Configure a PIM domain
border.
pim bsr-boundary
By default, no PIM domain border
is configured.
Configuring global C-BSR parameters
In each PIM-SM domain, a unique BSR is elected from C-BSRs. The C-RPs in the PIM-SM domain send
advertisement messages to the BSR. The BSR summarizes the advertisement messages to form an RP-set
and advertises it to all routers in the PIM-SM domain. All the routers use the same hash algorithm to get
the RP address that corresponds to specific multicast groups.