R0106-HP MSR Router Series Layer 3 - IP Services Command Reference(V7)

291
the MAC address of the interface and is globally unique. An attacker can exploit this rule to easily
identify the sending device.
To fix the vulnerability, you can enable the temporary address function. With this function, an IEEE 802
interface generates the following addresses:
• Public IPv6 address—Includes an address prefix in the RA message and a fixed interface ID
generated based on the MAC address of the interface.
• Temporary IPv6 address—Includes an address prefix in the RA message and a random interface ID
generated through MD5.
When the valid lifetime of a temporary IPv6 address expires, the system removes the address and
generates a new one. This enables the system to send packets with different source addresses through the
same interface. The preferred lifetime and valid lifetime for a temporary IPv6 address are determined as
follows:
• The preferred lifetime of a temporary IPv6 address takes the smaller of the following values:
{ The preferred lifetime of the address prefix in the RA message.
{ The preferred lifetime configured for temporary IPv6 addresses minus DESYNC_FACTOR (a
random number in the range of 0 to 600 seconds).
• The valid lifetime of a temporary IPv6 address takes the smaller of the following values:
{ The valid lifetime of the address prefix.
{ The valid lifetime configured for temporary IPv6 addresses.
Examples
# Enable the system to generate a temporary IPv6 address.
<Sysname> system-view
[Sysname] ipv6 temporary-address
Related commands
• ipv6 address auto
• ipv6 nd ra prefix
• ipv6 prefer temporary-address
ipv6 unreachables enable
Use ipv6 unreachables enable to enable sending ICMPv6 destination unreachable messages.
Use undo ipv6 unreachables to disable sending ICMPv6 destination unreachable messages.
Syntax
ipv6 unreachables enable
undo ipv6 unreachables enable
Default
Sending ICMPv6 destination unreachable messages is disabled.
Views
System view
Predefined user roles
network-admin