ipsec unicast-message sa(VPN instance PIM view/PIM view of a public network instance)

Function

The ipsec unicast-message sa command globally specifies a security association (SA) using which interfaces authenticate sent and received IPv4/IPv6 PIM unicast messages to implement IPv4/IPv6 PIM IPsec authentication.

The undo ipsec unicast-message sa command restores the default configuration.

By default, no SA is specified globally, so that interfaces do not authenticate sent or received IPv4/IPv6 PIM unicast messages.

Format

ipsec unicast-message sa sa-name

undo ipsec unicast-message sa

Parameters

Parameter	Description	Value
sa-name	Specifies the name of an SA.	It is a string of 1 to 15 case-sensitive characters, spaces not supported. The characters can be letters or numbers, hyphens (-) not supported. When double quotation marks are used around the string, spaces are allowed in the string.

Parameter

Description

Value

sa-name

Specifies the name of an SA.

It is a string of 1 to 15 case-sensitive characters, spaces not supported. The characters can be letters or numbers, hyphens (-) not supported. When double quotation marks are used around the string, spaces are allowed in the string.

Views

VPN instance PIM view, PIM view of a public network instance

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
pim	write

Usage Guidelines

Usage Scenario

On a multicast network, forged IPv6 PIM messages may be used to attack devices, causing devices unable to forward multicast traffic. To protect a device against attacks launched using forged IPv6 PIM messages, run the ipsec sa command to configure the device to authenticate the sent and received IPv6 PIM messages based on a specified SA.

On a multicast network, forged IPv4 PIM messages may be used to attack devices, causing devices unable to forward multicast traffic. To protect a device against attacks launched using forged IPv4 PIM messages, run the ipsec sa command to configure the device to authenticate sent and received IPv4 PIM messages based on a specified SA.

Prerequisites

Basic IPsec functions have been configured.

Example

# Globally configure IPv4 PIM IPsec to authenticate sent and received IPv4 PIM messages based on the SA named sa1.

<HUAWEI> system-view
[~HUAWEI] multicast routing-enable
[*HUAWEI] ipsec sa sa1
[*HUAWEI-ipsec-sa-sa1] quit
[*HUAWEI] pim
[*HUAWEI-pim] ipsec unicast-message sa sa1