Crp-Policy (Pim View) - HP 3600 v2 Series Command Reference Manual

crp-policy (PIM view)

Syntax
crp-policy acl-number
undo crp-policy
View
Public network PIM view, VPN instance PIM view
Default level
2: System level
Parameters
acl-number: Advanced ACL number, in the range of 3000 to 3999. When the ACL is defined, the source
keyword in the rule command specifies the address of a C-RP, and the destination keyword specifies the
address range of the multicast groups to which the C-RP is designated.
Description
Use crp-policy to configure a legal C-RP address range and the range of multicast groups to which the
C-RP is designated, in order to guard against C-RP spoofing.
Use undo crp-policy to remove the restrictions in C-RP address ranges and the ranges of multicast groups
to which the C-RP is designated.
By default, no restrictions are defined for C-RP address ranges and the address ranges of groups to which
the C-RP is designated. All received C-RP messages are accepted.
The crp-policy command filters the multicast group ranges advertised by C-RPs based on the group
prefixes. For example, if the multicast group range that a C-RP advertises is 224.1.0.0/16 and the legal
group range that the crp-policy command defines is 224.1.0.0/30, the multicast groups in the range of
224.1.0.0/16 can pass.
Related commands: c-rp.
Examples
# In the public network, configure a C-RP policy so that only devices in the address range of 1.1.1.1/24
can be C-RPs that provide services for multicast groups in the address range of 225.1.1.0/24.
<Sysname> system-view
[Sysname] acl number 3000
[Sysname-acl-adv-3000] rule permit ip source 1.1.1.1 0.0.0.255 destination 225.1.1.0
0.0.0.255
[Sysname-acl-adv-3000] quit
[Sysname] pim
[Sysname-pim] crp-policy 3000
# In VPN instance mvpn, configure a C-RP policy, so that only devices in the address range of 1.1.1.1/24
can be C-RPs that provide services for multicast groups in the address range of 225.1.1.0/24.
<Sysname> system-view
[Sysname] acl number 3000
[Sysname-acl-adv-3000] rule permit ip source 1.1.1.1 0.0.0.255 destination 225.1.1.0
0.0.0.255
[Sysname-acl-adv-3000] quit
[Sysname] pim vpn-instance mvpn
125