No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

NE40E V800R010C10SPC500 Configuration Guide - IP Multicast 01

This is NE40E V800R010C10SPC500 Configuration Guide - IP Multicast
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Configuring IPv4 PIM IPSec

Example for Configuring IPv4 PIM IPSec

On a PIM-SM network, you can configure IPv4 PIM IPSec on the interfaces setting up PIM neighbor relationships to protect the devices against forged IPv4 PIM protocol packets.

Networking Requirements

On the network shown in Figure 4-16, the multicast service is deployed. Device A and Device B set a PIM neighbor relationship and exchange IPv4 PIM protocol packets to maintain their neighbor relationship and multicast routing entries. If forged IPv4 PIM protocol packets exist, Device A and Device B may not forward multicast data properly. To prevent attacks, configure IPv4 PIM IPSec on the interfaces of Device A and Device B to authenticate the IPv4 PIM protocol packets transmitted between them. In this manner, malicious attacks are prevented, and users can receive multicast data from multicast sources.

Device B exchanges IGMP protocol packets with its connected users to maintain their member relationships. To protect Device B against forged IGMP protocols packets, configure IGMP IPSec on interfaces that connect Device B to users.

Figure 4-16 Configuring IPv4 PIM IPSec

Device Name

Interface

IP Address

Device A

GE1/0/0

192.168.1.1/24

GE1/0/1

192.168.2.1/24

Loopback0

1.1.1.1/32

Device B

GE1/0/0

192.168.2.2/24

GE1/0/1

192.168.3.1/24

Configuration Roadmap

The configuration roadmap is as follows:

  1. Assign an IP address to each router interface and configure IS-IS to implement IP interworking.

  2. Enable multicast routing on each router and PIM-SM on each router interface.

  3. Enable IGMP on interfaces connecting routers to hosts.

  4. Configure C-BSRs and C-RPs to implement dynamic RP selection.

  5. Configure basic IPSec functions.

  6. Configure global IPv4 PIM IPSec to authenticate unicast IPv4 PIM protocol packets.

  7. Configure IPv4 PIM IPSec on interfaces to authenticate multicast IPv4 PIM protocol packets.

  8. Configure IGMP IPSec on interfaces to authenticate IGMP protocol packets.

Data Preparation

To complete the configuration, you need the following data:

  • Multicast source address: 192.168.1.2

  • Multicast group address: 225.1.1.1

  • Security association (SA) name: sa1

Procedure

  1. Assign an IP address to each router interface and configure IS-IS to implement IP interworking.

    # Configure Device A.

    [~DeviceA] isis 1
    [*DeviceA-isis-1] network-entity 10.0000.0000.0001.00
    [*DeviceA-isis-1] quit
    [*DeviceA] interface gigabitethernet 1/0/0
    [*DeviceA-GigabitEthernet1/0/0] ip address 192.168.1.1 255.255.255.0
    [*DeviceA-GigabitEthernet1/0/0] isis enable 1
    [*DeviceA-GigabitEthernet1/0/0] quit
    [*DeviceA] interface gigabitethernet 1/0/1
    [*DeviceA-GigabitEthernet1/0/1] ip address 192.168.2.1 255.255.255.0
    [*DeviceA-GigabitEthernet1/0/1] isis enable 1
    [*DeviceA-GigabitEthernet1/0/1] quit
    [*DeviceA] interface LoopBack 0
    [*DeviceA-LoopBack0] ip address 1.1.1.1 255.255.255.255
    [*DeviceA-LoopBack0] isis enable 1
    [*DeviceA-LoopBack0] quit
    [*DeviceA] commit

    # Configure Device B.

    [~DeviceB] isis 1
    [*DeviceB-isis-1] network-entity 10.0000.0000.0002.00
    [*DeviceB-isis-1] quit
    [*DeviceB] interface gigabitethernet 1/0/0
    [*DeviceB-GigabitEthernet1/0/0] ip address 192.168.2.2 255.255.255.0
    [*DeviceB-GigabitEthernet1/0/0] isis enable 1
    [*DeviceB-GigabitEthernet1/0/0] quit
    [*DeviceB] interface gigabitethernet 1/0/1
    [*DeviceB-GigabitEthernet1/0/1] ip address 192.168.3.1 255.255.255.0
    [*DeviceB-GigabitEthernet1/0/1] isis enable 1
    [*DeviceB-GigabitEthernet1/0/1] quit
    [*DeviceB] commit

  2. Enable multicast routing on each router and PIM-SM on each router interface. Enable IGMP on interfaces connecting routers to hosts.

    # Configure Device A.

    [~DeviceA] multicast routing-enable
    [*DeviceA] interface gigabitethernet 1/0/0
    [*DeviceA-GigabitEthernet1/0/0] pim sm
    [*DeviceA-GigabitEthernet1/0/0] quit
    [*DeviceA] interface gigabitethernet 1/0/1
    [*DeviceA-GigabitEthernet1/0/1] pim sm
    [*DeviceA-GigabitEthernet1/0/1] quit
    [*DeviceA] interface LoopBack 0
    [*DeviceA-LoopBack0] pim sm
    [*DeviceA-LoopBack0] quit
    [*DeviceA] commit

    # Configure Device B.

    [~DeviceB] multicast routing-enable
    [*DeviceB] interface gigabitethernet 1/0/0
    [*DeviceB-GigabitEthernet1/0/0] pim sm
    [*DeviceB-GigabitEthernet1/0/0] quit
    [*DeviceB] interface gigabitethernet 1/0/1
    [*DeviceB-GigabitEthernet1/0/1] pim sm
    [*DeviceB-GigabitEthernet1/0/1] igmp enable
    [*DeviceB-GigabitEthernet1/0/1] igmp static-group 225.1.1.1 source 192.168.1.2
    [*DeviceB-GigabitEthernet1/0/1] quit
    [*DeviceB] commit

  3. Configure dynamic RP selection.

    # Specify loopback 0 on Device A as a C-BSR and a C-RP.

    [~DeviceA] pim
    [*DeviceA-pim] c-bsr Loopback 0
    [*DeviceA-pim] c-rp Loopback 0
    [*DeviceA-pim] quit
    [*DeviceA] commit

  4. Configure basic IPSec functions.

    • Configure the IPSec transmission mode.

      # Configure Device A.

      [~DeviceA] ipsec proposal aaa
      [*DeviceA-ipsec-proposal-aaa] transform ah
      [*DeviceA-ipsec-proposal-aaa] quit
      [*DeviceA] commit

      # Configure Device B.

      [~DeviceB] ipsec proposal aaa
      [*DeviceB-ipsec-proposal-aaa] transform ah
      [*DeviceB-ipsec-proposal-aaa] quit
      [*DeviceB] commit
    • Configure IPSec SAs.

      # Configure Device A.

      [~DeviceA] ipsec sa sa1
      [*DeviceA-ipsec-sa-sa1] proposal aaa
      [*DeviceA-ipsec-sa-sa1] sa spi inbound ah 300
      [*DeviceA-ipsec-sa-sa1] sa spi outbound ah 300
      [*DeviceA-ipsec-sa-sa1] sa string-key inbound ah Huawei-123
      [*DeviceA-ipsec-sa-sa1] sa string-key outbound ah Huawei-123
      [*DeviceA-ipsec-sa-sa1] quit
      [*DeviceA] commit

      # Configure Device B.

      [~DeviceB] ipsec sa sa1
      [*DeviceB-ipsec-sa-sa1] proposal aaa
      [*DeviceB-ipsec-sa-sa1] sa spi inbound ah 300
      [*DeviceB-ipsec-sa-sa1] sa spi outbound ah 300
      [*DeviceB-ipsec-sa-sa1] sa string-key inbound ah Huawei-123
      [*DeviceB-ipsec-sa-sa1] sa string-key outbound ah Huawei-123
      [*DeviceB-ipsec-sa-sa1] quit
      [*DeviceB] commit

  5. Configure global IPv4 PIM IPSec to authenticate unicast IPv4 PIM protocol packets.

    # Configure Device A.

    [~DeviceA] pim
    [*DeviceA-pim] ipsec unicast-message sa sa1
    [*DeviceA-pim] quit
    [*DeviceA] commit

    # Configure Device B.

    [~DeviceB] pim
    [*DeviceB-pim] ipsec unicast-message sa sa1
    [*DeviceB-pim] quit
    [*DeviceB] commit

  6. Configure IPv4 PIM IPSec on interfaces.

    # Configure Device A.

    [~DeviceA] interface gigabitethernet 1/0/1
    [*DeviceA-GigabitEthernet1/0/1] pim ipsec sa sa1
    [*DeviceA-GigabitEthernet1/0/1] quit
    [*DeviceA] commit

    # Configure Device B.

    [~DeviceB] interface gigabitethernet 1/0/0
    [*DeviceB-GigabitEthernet1/0/0] pim ipsec sa sa1
    [*DeviceB-GigabitEthernet1/0/0] quit
    [*DeviceB] commit

  7. Configure IGMP IPSec on interfaces.

    [~DeviceB] interface gigabitethernet 1/0/1
    [*DeviceB-GigabitEthernet1/0/1] igmp ipsec sa sa1
    [*DeviceB-GigabitEthernet1/0/1] quit
    [*DeviceB] commit

  8. Verify the configuration.

    # Configure the multicast source 192.168.1.2 to send data to the multicast group 225.1.1.1. Configure a receiver to send an IGMP Report message to join the multicast group. Ensure that the receiver receives data from the multicast source. Run the display pim interface verbose command. The command outputs show detailed configurations of IPv4 PIM IPSec on interfaces between routers.

    [~DeviceA] display pim interface gigabitethernet 1/0/1 verbose
     VPN-Instance: public net
     Interface: GigabitEthernet1/0/1, 192.168.2.1
         PIM version: 2
         PIM mode: Sparse
         PIM state: up
         PIM DR: 192.168.2.1 (local)
         PIM DR Priority (configured): 1
         PIM neighbor count: 0
         PIM hello interval: 30 s
         PIM LAN delay (negotiated): 500 ms
         PIM LAN delay (configured): 500 ms
         PIM hello override interval (negotiated): 2500 ms
         PIM hello override interval (configured): 2500 ms
         PIM Silent: disabled
         PIM neighbor tracking (negotiated): disabled
         PIM neighbor tracking (configured): disabled
         PIM generation ID: 0x2C24084
         PIM require-GenID: disabled
         PIM hello hold interval: 105 s
         PIM assert hold interval: 180 s
         PIM triggered hello delay: 5 s
         PIM J/P interval: 60 s
         PIM J/P hold interval: 210 s
         PIM BSR domain border: disabled
         PIM BFD: disabled
         PIM dr-switch-delay timer: not configured
         Number of routers on link not using DR priority: 0
         Number of routers on link not using LAN delay: 0
         Number of routers on link not using neighbor tracking: 1
         ACL of PIM neighbor policy: -
         ACL of PIM ASM join policy: -
         ACL of PIM SSM join policy: -
         ACL of PIM join policy: -
         PIM ipsec: enabled(sa-name: sa1)
    [~DeviceB] display pim interface gigabitethernet 1/0/0 verbose
     VPN-Instance: public net
     Interface: GigabitEthernet1/0/0, 192.168.2.2
         PIM version: 2
         PIM mode: Sparse
         PIM state: up
         PIM DR: 192.168.2.2 (local)
         PIM DR Priority (configured): 1
         PIM neighbor count: 0
         PIM hello interval: 30 s
         PIM LAN delay (negotiated): 500 ms
         PIM LAN delay (configured): 500 ms
         PIM hello override interval (negotiated): 2500 ms
         PIM hello override interval (configured): 2500 ms
         PIM Silent: disabled
         PIM neighbor tracking (negotiated): disabled
         PIM neighbor tracking (configured): disabled
         PIM generation ID: 0x30F1A3DD
         PIM require-GenID: disabled
         PIM hello hold interval: 105 s
         PIM assert hold interval: 180 s
         PIM triggered hello delay: 5 s
         PIM J/P interval: 60 s
         PIM J/P hold interval: 210 s
         PIM BSR domain border: disabled
         PIM BFD: disabled
         PIM dr-switch-delay timer: not configured
         Number of routers on link not using DR priority: 0
         Number of routers on link not using LAN delay: 0
         Number of routers on link not using neighbor tracking: 1
         ACL of PIM neighbor policy: -
         ACL of PIM ASM join policy: -
         ACL of PIM SSM join policy: -
         ACL of PIM join policy: -
         PIM ipsec: enabled(sa-name: sa1)

    # Run the display igmp interface verbose command. The command outputs show detailed configurations of IGMP IPSec on interfaces connected to users.

    [~DeviceB] display igmp interface gigabitethernet 1/0/1 verbose
    Interface information of VPN-Instance: public net
     Gigabitethernet1/0/1(192.168.3.1):
       IGMP is enabled
       Current IGMP version is 2
       IGMP state: up
       IGMP group policy: none
       IGMP limit: -
       Value of query interval for IGMP (negotiated): -
       Value of query interval for IGMP (configured): 60 s
       Value of other querier timeout for IGMP: 0 s
       Value of maximum query response time for IGMP: 10 s
       Value of last member query time: 2 s
       Value of last member query interval: 1 s
       Value of startup query interval: 15 s
       startup query count: 2
       General query timer expiry (hours:minutes:seconds): 00:00:58
       Querier for IGMP: 192.168.3.1 (this router)
       IGMP activity: 0 joins, 0 leaves
       Robustness (negotiated): -
       Robustness (configured): 2
       Require-router-alert: disabled
       Send-router-alert: enabled
       Ip-source-policy: disabled
       Query Ip-source-policy: disabled
       Prompt-leave: disabled
       SSM-Mapping: disabled
       Startup-query-timer-expiry: off
       Other-querier-present-timer-expiry: off
       IGMP ipsec: enabled(sa-name: sa1)

    The preceding command outputs show the following information: IPv4 PIM IPSec is configured on the downstream interface GE 1/0/1 of Device A and the upstream interface GE 1/0/0 of Device B. IGMP IPSec is configured on the downstream interface GE 1/0/1 of Device, and the SA name is sa1.

    # Run the display pim routing-table command to check the IPv4 PIM routing table. The command output shows that multicast routing entries exist on Device B.

    [~DeviceB] display pim routing-table
     VPN-Instance: public net
     Total 0 (*, G) entry; 1 (S, G) entry
    
     (192.168.1.2, 225.1.1.1)
         RP: 1.1.1.1
         Protocol: pim-sm, Flag: SPT NIIF SG_RCVR
         UpTime: 00:31:41
         Upstream interface: Gigabitethernet1/0/0
             Upstream neighbor: 192.168.2.1
             RPF prime neighbor: 192.168.2.1
         Downstream interface(s) information:
         Total number of downstreams: 1
            1: Gigabitethernet1/0/1
                 Protocol: static, UpTime: 00:31:41, Expires: -     

    The preceding command output shows that multicast data is received by the receiver.

Configuration Files

  • Device A configuration file

    #
    sysname DeviceA
    #
    ipsec proposal aaa
     transform ah
    #
    ipsec sa sa1
     proposal aaa
     sa spi inbound ah 300
     sa string-key inbound ah cipher @%@%QV3G<F;#>(tQfj-P_31%&R.v@%@%
     sa spi outbound ah 300
     sa string-key outbound ah cipher @%@%StJa=GZQXOj#,G.F9n^,&R/S@%@%
    #
    multicast routing-enable
    #
    isis 1
     network-entity 10.0000.0000.0001.00  
    #
    interface Gigabitethernet1/0/0
     undo shutdown
     ip address 192.168.1.1 255.255.255.0
     pim sm
     isis enable 1
    #
    interface Gigabitethernet1/0/1
     undo shutdown
     ip address 192.168.2.1 255.255.255.0
     pim sm
     pim ipsec sa sa1
     isis enable 1  
    #
    interface LoopBack0
     ip address 1.1.1.1 255.255.255.255
     pim sm
     isis enable 1 
    #
    pim
     c-bsr LoopBack0
     c-rp LoopBack0
     ipsec unicast-message sa sa1
    #
    return
  • Device B configuration file

    #
    sysname DeviceB
    #
    ipsec proposal aaa
     transform ah  
    #
    ipsec sa sa1
     proposal aaa
     sa spi inbound ah 300
     sa string-key inbound ah cipher @%@%gbFH@o`[IC!-*3DM![X$&R&.@%@%
     sa spi outbound ah 300
     sa string-key outbound ah cipher @%@%M\a(7*eg-J8r|+'9`_~A&R-C@%@%   
    #
    multicast routing-enable
    #
    isis 1
     network-entity 10.0000.0000.0002.00     
    #
    interface Gigabitethernet1/0/1
     undo shutdown
     ip address 192.168.3.1 255.255.255.0
     pim sm
     igmp enable
     igmp ipsec sa sa1
     igmp static-group 225.1.1.1 source 192.168.1.2
     isis enable 1
    #
    interface Gigabitethernet1/0/0
     undo shutdown
     ip address 192.168.2.2 255.255.255.0
     pim sm
     pim ipsec sa sa1
     isis enable 1
    #
    pim
     ipsec unicast-message sa sa1
    #
    return
Translation
Download
Updated: 2019-01-03

Document ID: EDOC1100055017

Views: 40717

Downloads: 97

Average rating:
This Document Applies to these Products
Related Version
Related Documents
Share
Previous Next