crp-policy (IPv6 PIM view)
Use crp-policy to configure a C-RP policy.
Use undo crp-policy to restore the default.
Syntax
crp-policy ipv6-acl-number
undo crp-policy
Default
No C-RP policy exists, and all C-RP messages are regarded as legal.
Views
IPv6 PIM view
Predefined user roles
network-admin
mdc-admin
Parameters
ipv6-acl-number: Specifies an IPv6 advanced ACL number in the range of 3000 to 3999.
Usage guidelines
A C-RP policy filters C-RP advertisement messages to guard against C-RP spoofing.
The device uses only the prefixes of the multicast group ranges in advertisement messages to match the destination field in ACL rules. For example, the IPv6 multicast group range in a C-RP advertisement message is FF0E:0:1::/96. If the prefix FF0E:0:1:: is in the range specified by the destination field of an ACL rule, the specified C-RPs are designated to this IPv6 multicast group range.
When you configure a rule in the IPv6 ACL, follow these restrictions and guidelines:
For the rule to take effect, do not specify the vpn-instance vpn-instance option.
The source source-address source-prefix option specifies an RP address.
The destination dest-address dest-prefix option specifies an IPv6 multicast group address.
Among the other optional parameters, only the fragment keyword and the time-range time-range-name option take effect.
If you execute this command multiple times, the most recent configuration takes effect.
Examples
# Configure a C-RP policy on the public network so that only devices in the address range of 2001::2/64 can be C-RPs for the groups in the range of FF03::101/64.
<Sysname> system-view [Sysname] acl ipv6 advanced 3000 [Sysname-acl-ipv6-adv-3000] rule permit ipv6 source 2001::2 64 destination ff03::101 64 [Sysname-acl-ipv6-adv-3000] quit [Sysname] ipv6 pim [Sysname-pim6] crp-policy 3000
Related commands
c-rp (IPv6 PIM view)