(Optional) Configuring the Range of Valid C-RP Addresses

ACL-based policies can be set on all Candidate-BSRs (C-BSRs) to filter Candidate-RP (C-RP) addresses and addresses of the groups that the C-RPs serve. The BootStrap router (BSR) adds C-RP information to the RP-set only when the addresses are in the set legal address range. Therefore, C-RP spoofing is avoided.

Prerequisites

Before configuring the range of valid C-RP addresses, complete the following tasks:

Configuring a unicast routing protocol
Configuring Basic PIM-SM Functions

Context

Perform the following steps on all the C-BSRs in the PIM-SM domain:

This configuration is optional. By default, a FW does not check the C-RP address and the group address contained in a received Advertisement message and adds them to the RP-set.

Procedure

Access the system view.
system-view
Create an advanced ACL and access its view.
acl [ number ] acl-number [ vpn-instance vpn-instance-name ]
Configure rules for the advanced ACL.
rule [ rule-id ] { permit | deny } protocol [ source { source-ip-address { 0 | source-wildcard } | address-set address-set-name | any } | destination { destination-ip-address { 0 | destination-wildcard } | address-set address-set-name | any } ] ^*

Run the rule command, set the source parameter to a valid C-RP source address range, and set the destination parameter to a multicast group address range to be served by C-RPs.
Return to the system view.
quit
Access the PIM view.
pim [ vpn-instance vpn-instance-name ]
Specify the range of the valid C-RP addresses and the range of the multicast group addresses that a FW serves.
crp-policy advanced-acl-number

When receiving an Advertisement message, the FW checks the C-RP address and the addresses of the groups that the C-RP serves in the message. The C-RP address and the addresses of the groups that the C-RP serves are added to the RP-Set only when they are in the valid address range. The C-RP spoofing can thus be prevented.

advanced-acl-number specifies the advanced ACL. The ACL defines the filtering policy for the C-RP address range and the address range of the groups that a C-RP serves.
- If an Advertisement message from a C-RP matches an ACL rule and the action is permit, the BSR permits this message.
- If an Advertisement message from a C-RP matches an ACL rule and the action is deny, the BSR denies this message.
- If an Advertisement message from a C-RP does not match any ACL rule, the BSR denies this message.
- If a specified ACL does not exist or does not contain rules, the BSR denies all messages from any C-RP.