How to Configure Security Policies to Allow LDP
Label Distribution Protocol (LDP) is widely used in the Multiprotocol Label Switching (MPLS) system. Label switching routers (LSRs) exchange messages such as label mapping and release messages through LDP sessions. The process of establishing an LDP session involves the following phases: discovery, TCP three-way handshake, session establishment, and message exchange.
In the LDP discovery phase, Hello messages are sent through UDP packets, and the destination port number is 646. The following LDP discovery mechanisms are supported: basic discovery and extended discovery.
Discovery Mechanism |
Application Scenario |
Message |
Destination Address |
Destination Port |
Initiator |
|---|---|---|---|---|---|
Basic discovery |
Discovers directly connected LSR peers on the link. |
Link Hello |
224.0.0.2 (multicast) |
UDP: 646 |
Two-way (symmetric) |
Extended discovery |
Discovers LSR peers not directly connected on a link. |
Targeted Hello |
Specified peer IP address (unicast) |
UDP: 646 |
Triggered by the initiator (asymmetric) |
After the discovery phase, the initiator initiates a TCP connection request, establishes a TCP connection and an LDP session, and exchanges messages using TCP unicast packets. The destination port number is 646. In the basic discovery mechanism, the initiator is the party with a larger transport address. In the extended discovery mechanism, the initiator is manually specified. In this document, the firewall functions as the initiator.
No. |
Name |
Source Security Zone |
Destination Security Zone |
Source Address/Region |
Destination Address/Region |
Service |
Action |
|---|---|---|---|---|---|---|---|
101 |
Allow ldp basic discovery |
Local |
Untrust |
10.1.1.10/24 |
10.1.1.1/24 |
ldp-tcp (TCP: 646) |
permit |
102 |
Allow ldp extended discovery |
Local |
Untrust |
10.1.1.10/24 |
10.1.2.1/24 |
ldp-tcp (TCP: 646) ldp-udp (UDP: 646) |
permit |
If the initiator cannot be determined, you can configure security policies in both directions, view the policy matching statistics, and delete the security policy that has never been matched.