No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

ME60 V800R010C10SPC500 Feature Description - IP Multicast 01

This is ME60 V800R010C10SPC500 Feature Description - IP Multicast
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
PIM Security

PIM Security

To ensure that multicast services are correctly transmitted on networks, PIM security is implemented to limit the valid BSR and C-RP address ranges, filter packets, and check PIM neighbors.

Table 4-3 PIM security features

PIM Security Feature

Applicable Protocol

Purpose

Principle

Applicable Device

Protected Device

Limit on the BSR address range

IPv4 PIM-SM

IPv6 PIM-SM

Any router on a PIM-SM network that uses the BootStrap router (BSR) mechanism can be configured as a Candidate-BootStrap Router (C-BSR) and participate in a BSR election. The winner of the BSR election is responsible for advertising rendezvous point (RP) information.

This function is used to guarantee BSR security by preventing BSR spoofing and malicious hosts from replacing valid BSRs.

An ACL and filtering rules can be configured to limit the range of valid BSR addresses. Consequently, devices will discard BSR packets carrying BSR addresses outside the valid address range.

All multicast devices on a network

BSR

Limit on the C-RP address range

IPv4 PIM-SM

IPv6 PIM-SM

Any router on a PIM-SM network that uses the BSR mechanism can be configured as a Candidate-Rendezvous Point (C-RP) and serve multicast groups in a specified range. Each C-RP unicasts an Advertisement message to the BSR. The BSR collects all received C-RP information and summarizes it as the RP-Set, and floods the RP-Set over the entire network using Bootstrap messages. Based on the RP-Set, routers on the network can calculate out the RP to which a multicast group in a specific range corresponds.

This function is used to guarantee C-RP security by preventing C-RP spoofing and malicious hosts from replacing valid C-RPs. With this function, an RP can be correctly elected.

An ACL and filtering rules can be configured to limit the range of valid C-RP addresses and the range of multicast groups that each C-RP serves. Then the BSR will discard Advertisement messages carrying C-RP addresses outside the valid C-RP address range.

C-BSR

RP

Limit on the number of PIM entries

IPv4 PIM-SM

IPv4 PIM-SSM

This feature is used to limit the number of PIM-SM/PIM-SSM entries to prevent a device from generating excessive multicast routing entries when attackers send numerous multicast data or IGMP/PIM protocol messages. Therefore, this feature helps prevent high memory and CPU usage and improve multicast service security.

A PIM entry number limit can be configured globally to restrict the maximum number of PIM-SM/PIM-SSM entries that can be created. After the specified limit is reached, the device will not create new PIM-SM/PIM-SSM entries.

PIM (*, G) and (S, G) entries are limited separately.

  • After the specified limit for PIM (*, G) entries is reached, the device will stop creating PIM-SM (*, G) entries.
  • After the specified limit for PIM (S, G) entries is reached, the device will stop creating PIM-SM/PIM-SSM (*, G) entries.

All PIM devices on a network.

All PIM devices on a network.

Register message filtering

IPv4 PIM-SM

IPv6 PIM-SM

Any new multicast source on a PIM-SM network must initially register with the RP. The RP forwards multicast data sent by a multicast source to group members after receiving a Register message from the multicast source's designated router (DR).

This function is used to protect the network against invalid Register messages from malicious devices. With this function, multicast forwarding trees can be correctly set up so that multicast data can be correctly sent to receivers.

An ACL and filtering rules can be configured to enable the RP to filter Register messages received from the multicast source's DR.

RP

RP

PIM neighbor filtering

IPv4 PIM-SM

IPv6 PIM-SM

IPv4 PIM-SSM

IPv6 PIM-SSM

Some unknown devices on a network may set up PIM neighbor relationships with a multicast router and prevent the multicast router from functioning as a DR.

This function is used to prevent a multicast router from setting up PIM neighbor relationships with unknown devices and prevent an unknown router from becoming a DR.

An ACL and filtering rules can be configured to enable interfaces to set up neighbor relationships only with interfaces with valid addresses and to delete neighbors with invalid addresses.

All multicast devices on a network

All multicast devices on a network

Join information filtering

IPv4 PIM-SM

IPv6 PIM-SM

IPv4 PIM-SSM

IPv6 PIM-SSM

A Join/Prune message received by an interface contains both join and prune information.

This function is used to filter join information to prevent unauthorized users from joining multicast groups.

An ACL and filtering rules can be configured to filter join information. Devices create PIM entries based on valid Join information.

All multicast devices on a network

All multicast devices on a network

Source address-based filtering

IPv4 PIM-SM

IPv6 PIM-SM

IPv4 PIM-SSM

IPv6 PIM-SSM

This function enables a device to filter multicast data packets based on source or source/group addresses, ensuring the security of multicast data packets.

An ACL and filtering rules can be configured to enable devices to forward multicast packets carrying source or source/group addresses within the valid source or source/group address range.

All multicast devices on a network

All multicast devices on a network

PIM neighbor check

IPv4 PIM-SM

IPv6 PIM-SM

IPv4 PIM-SSM

IPv6 PIM-SSM

This function guarantees the security of Join/Prune or Assert messages received or sent by devices.

When receiving or sending Join/Prune or Assert messages, a device checks whether the messages are sent to or received from a PIM neighbor. If these messages are not sent to or received from a PIM neighbor, these messages will be discarded.

All multicast devices on a network

All multicast devices on a network

PIM silent

IPv4 PIM-SM

IPv6 PIM-SM

IPv4 PIM-SSM

IPv6 PIM-SSM

If PIM-SM is enabled on the interface directly connecting a multicast device to user hosts, this interface can set up PIM neighbor relationships and process PIM packets. If a malicious host sends pseudo PIM Hello packets to the multicast device, the multicast device may break down.

This function is used to protect interfaces of PIM-SM devices against pseudo PIM Hello packets.

The interface is not allowed to receive or forward any PIM packets and all PIM neighbor relationships established by this interface are deleted.

Interface directly connected to the user host network segment that has only one PIM device

PIM devices directly connected to user host network segments.

PIM IPsec

IPv4 PIM-SM

IPv6 PIM-SM

IPv4 PIM-SSM

IPv6 PIM-SSM

This function is used to authenticate PIM packets to prevent bogus PIM protocol packet attacks or denial of service (DoS) attacks, improving multicast service security.

PIM IPsec uses security association (SA) to authenticate sent and received PIM packets. The PIM IPsec implementation process is as follows:
  • Before an interface sends out a PIM protocol packet, IPsec adds a protocol header to the packet.
  • After an interface receives a PIM protocol packet, IPsec uses a protocol header to authenticate the protocol header in the packet. If the is authentication is successful, the packet is forwarded. Otherwise, the packet is discarded.
PIM IPsec can authenticate the following types of PIM packets:
  • PIM multicast protocol packets, such as Hello and Join/Prune packets.
  • PIM unicast protocol packets, such as Register and Register-Stop packets.
NOTE:
For IPsec feature description, see IPsec.

All PIM devices on a network.

All PIM devices on a network.

Translation
Download
Updated: 2019-01-04

Document ID: EDOC1100059456

Views: 11445

Downloads: 13

Average rating:
This Document Applies to these Products
Related Version
Related Documents
Share
Previous Next