HP MSR2000/3000/4000 Router Series Layer 3 - IP Services Command Reference

258
ipv6 temporary-address
Use ipv6 temporary-address to enable the system to generate a temporary IPv6 address.
Use undo ipv6 temporary-address to disable the system from generating a temporary IPv6 address and
remove the existed temporary addresses.
Syntax
ipv6 temporary-address [ valid-lifetime preferred-lifetime ]
undo ipv6 temporary-address
Default
The system does not generate any temporary IPv6 address.
Views
System view
Predefined user roles
network-admin
Parameters
valid-lifetime: Specifies the valid lifetime for temporary IPv6 addresses, in the range of 600 to
4294967295 seconds. The default valid lifetime is 604800 seconds (7 days). The valid lifetime must be
greater than or equal to the preferred lifetime.
preferred-lifetime: Specifies the preferred lifetime for temporary IPv6 addresses, in the range of 600 to
4294967295 seconds. The default preferred lifetime is 86400 seconds (1 day).
Usage guidelines
You must enable stateless autoconfiguration before configuring the temporary address function.
The stateless address autoconfiguration enables an interface to automatically generate an IPv6 global
unicast address by using the address prefix in the received RA message and the interface ID. On an IEEE
802 interface (such as an Ethernet interface or a VLAN interface), the interface ID is generated based on
the MAC address of the interface and is globally unique. An attacker can exploit this rule to identify the
sending device easily.
To fix the vulnerability, you can configure the temporary address function. With this function, an IEEE 802
interface generates the following addresses:
• Public IPv6 address—Includes an address prefix in the RA message and a fixed interface ID
generated based on the MAC address of the interface.
• Temporary IPv6 address—Includes an address prefix in the RA message and a random interface ID
generated through MD5.
When the valid lifetime of a temporary IPv6 address expires, the system removes the address and
generates a new one. This enables the system to send packets with different source addresses through the
same interface. The preferred lifetime and valid lifetime for a temporary IPv6 address are determined as
follows:
• The preferred lifetime of a temporary IPv6 address takes the smaller of the following values:
{ The preferred lifetime of the address prefix in the RA message.
{ The preferred lifetime configured for temporary IPv6 addresses minus DESYNC_FACTOR (a
random number in the range of 0 to 600 seconds).