mld query ipsec sa

Function

The mld query ipsec sa command specifies a security association (SA) using which an interface authenticates sent and received Multicast Listener Discovery (MLD) Query messages to implement IP Security (IPsec) authentication.

The undo mld query ipsec sa command restores the default configuration.

By default, no SA is specified on an interface, so that the interface does not authenticate sent or received MLD Query messages.

Format

mld query ipsec sa sa-name

undo mld query ipsec sa

Parameters

Parameter	Description	Value
sa-name	Specifies the name of an SA.	It is a string of 1 to 15 case-sensitive characters, spaces not supported. The characters can be letters or numbers, hyphens (-) not supported. When double quotation marks are used around the string, spaces are allowed in the string.

Parameter

Description

Value

sa-name

Specifies the name of an SA.

It is a string of 1 to 15 case-sensitive characters, spaces not supported. The characters can be letters or numbers, hyphens (-) not supported. When double quotation marks are used around the string, spaces are allowed in the string.

Views

100ge sub-interface view, 100GE interface view, 10GE sub-interface view, 10GE interface view, 200GE sub-interface view, 25GE sub-interface view, 25GE interface view, 400GE sub-interface view, 400GE interface view, 40GE sub-interface view, 40GE interface view, 50GE sub-interface view, 50GE interface view, Eth-Trunk sub-interface view, Eth-Trunk interface view, FlexE interface view, GE optical interface view, GE sub-interface view, GE interface view, GE electrical interface view, Global VE sub-interface view, Loopback interface view, PW-VE sub-interface view, VE sub-interface view, VLANIF interface view

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
igmp	write

Usage Guidelines

Usage Scenario

On a multicast network, forged MLD Query messages may be used to attack devices, causing devices unable to forward multicast traffic. To protect a device against attacks launched using forged MLD Query messages, run the mld query ipsec sa command to configure an interface to authenticate sent and received MLD Query messages based on a specified SA.

The mld query ipsec sa command configuration enables an interface to authenticate only MLD Query messages.

Prerequisites

The multicast routing function has been enabled using the multicast ipv6 routing-enable command.
Basic IPsec functions have been configured.

Precautions

If the mld query ipsec sa command is run more than once, the latest configuration overrides the previous one. If the mld query ipsec sa and mld ipsec sa commands are both configured, the command configured later overrides the command configured earlier.

The function of this command is the same as that of the query ipsec sa command used in the MLD view. The configuration in the interface view takes precedence over the configuration in the MLD view. The configuration in the MLD view is used only when the configuration in the interface view is not available.

Example

# Configure GE 0/1/0 to authenticate sent and received MLD Query messages based on the SA named sa1.

<HUAWEI> system-view
[~HUAWEI] multicast ipv6 routing-enable
[*HUAWEI-GigabitEthernet0/1/0] ipsec sa sa1
[*HUAWEI-GigabitEthernet0/1/0-ipsec-sa-sa1] quit
[*HUAWEI] interface GigabitEthernet 0/1/0
[*HUAWEI-GigabitEthernet0/1/0] ipv6 enable
[*HUAWEI-GigabitEthernet0/1/0] mld query ipsec sa sa1