H3C S7500 Series Ethernet Switches Command Manual

Command Manual – Multicast
H3C S7500 Series Ethernet Switches Chapter 6
PIM Configuration Commands
6-1
Chapter 6 PIM Configuration Commands
6.1 PIM Configuration Commands
6.1.1 bsr-policy
Syntax
bsr-policy acl-number
undo bsr-policy
View
PIM view
Parameters
acl-number: ACL number adopted in BSR filtering policy, in the range of 2,000 to 2,999.
Description
Use the bsr-policy command to limit the range of legal BSRs to prevent BSR proofing.
Use the undo bsr-policy command to restore the default setting, that is, no range limit
is set and all received messages are taken as legal.
In the PIM SM network using BSR (bootstrap router) mechanism, every router can set
itself as C-BSR (candidate BSR) and take the authority to advertise RP information in
the network once it wins in the BSR election. To prevent malicious BSR proofing in the
network, the following two measures need to be taken:
z Prevent the router from being spoofed by hosts though faking legal BSR
messages to modify RP mapping. BSR messages are multicast messages with
their TTL values being 1, so this type of attacks often strike edge routers.
Fortunately, BSRs are inside the network, while assaulting hosts are outside,
therefore neighbor and RPF checks can be used to guard against this type of
attacks.
z If a router in the network is manipulated by an attacker, or an illegal router is
accessed into the network, the attacker may set itself as a C-BSR and try to win
the BSR election to gain the authority to advertise RP information within the
network. Since the router configured as a C-BSR shall propagate BSR messages,
which are multicast messages sent hop by hop with TTL as 1, throughout the
network, then the network will be affected as long as the peer routers do not
receive these BSR messages. One solution is to configure the bsr-policy
command on each router to define the legal BSR range, for example, only