RIP/RIPng

Attack Behavior

Injection of bad routing information

Routing Information Protocol (RIP)/RIP next generation (RIPng) accepts any packet from valid source addresses that match the configured network information. RIP/RIPng packets carry direct route data; therefore, invalid or incorrect routing information may be included in the route data, causing inaccurate routing database calculation and network failures.
Replay attack

Attackers intercept RIP packets and send packets to a switch repeatedly, increasing the load on the switch.

Security Policy

To defend against the preceding attacks, configure the following security policies on a switch:

RIP authentication

RIP version 2 (RIPv2) supports protocol packet authentication to prevent bad routing information, error packets, and replay attacks from networks. Three authentication modes are available: simple authentication, MD5 authentication, and HMAC-SHA256 authentication. Simple authentication and MD5 authentication have potential security risks. HMAC-SHA256 authentication is recommended.
CPCAR

CPCAR limits the rate of RIP/RIPng packets sent to the control plane to ensure control plane security.

Configuration Method

Configure RIP authentication.

Configure HMAC-SHA256 authentication, and set the authentication password to admin@huawei and authentication identifier to 255.
```
<HUAWEI> system-view
[HUAWEI] interface vlanif 100
[HUAWEI-Vlanif100] rip authentication-mode hmac-sha256 cipher admin@huawei 255
```

Modify the CPCAR value of RIP/RIPng packets.

Improper CPCAR settings will affect services. If you need to adjust CPCAR settings, contact technical support personnel.

Change the rate of sending RIP packets to 64 kbit/s.

<HUAWEI> system-view
[HUAWEI] cpu-defend policy 1
[HUAWEI-cpu-defend-policy-1] car packet-type rip cir 64
[HUAWEI-cpu-defend-policy-1] quit
[HUAWEI] cpu-defend-policy 1 global
[HUAWEI] cpu-defend-policy 1

Change the rate of sending RIPng packets to 64 kbit/s.

<HUAWEI> system-view
[HUAWEI] cpu-defend policy 1
[HUAWEI-cpu-defend-policy-1] car packet-type ripng cir 64
[HUAWEI-cpu-defend-policy-1] quit
[HUAWEI] cpu-defend-policy 1 global
[HUAWEI] cpu-defend-policy 1